fix(security): raise dependency floors for the 2026-09-08 advisories (#414)

Every one of these advisories was published on 2026-09-08 between 20:30 and 21:26 UTC, against the versions this repository was already pinning from the earlier rounds. Same package names, new CVEs, not a regression from anything that merged today.

**Application** (the nine Docker Scout alerts on main)

| Package | Was | Now | Advisory |
| --- | --- | --- | --- |
| astro | 7.1.0 | 7.3.2 (floor ^7.2.8) | GHSA-26w7-cxv4-gfx2, remote code execution through AVIF image optimization (critical) |
| @xmldom/xmldom | 0.8.13 | 0.8.15 | eight advisories, CVE-2026-83605 through CVE-2026-83619 (high) |
| sharp | floor ^0.35.0 | ^0.35.4 | GHSA-rgj7-g3m4-5g8c, libheif |
| js-yaml | floor ^4.3.1 | ^4.3.2 | GHSA-2883-xcg3-v3hh |
| svgo | (no floor) | ^4.1.0 | GHSA-w27v-7q3p-w38r, GHSA-4vpr-x523-8j87 |

**Documentation site** (the six Dependabot alerts against `www/pnpm-lock.yaml`)

astro to ^7.2.8 (resolves 7.3.2), and pnpm overrides for sharp ^0.35.4, svgo ^4.1.0 and js-yaml ^4.3.2. That covers all six, including the moderate Astro authorization bypass (GHSA-376h-93r7-7g6f) which 7.2.4 already fixed.

This supersedes the two Dependabot pull requests, which only cover the site and overlap with each other.

Checked: 906 tests pass, `bun run build` passes, and the site builds its 37 pages. The lockfile change is confined to the bumped packages and their transitive resolution.

www/package.json

@@ -19,7 +19,7 @@
     "@types/canvas-confetti": "^1.9.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "astro": "^7.1.0",
+    "astro": "^7.2.8",
     "canvas-confetti": "^1.9.4",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
@@ -35,7 +35,10 @@
   "packageManager": "pnpm@10.32.1",
   "pnpm": {
     "overrides": {
-      "esbuild@>=0.27.3 <0.28.1": ">=0.28.1"
+      "esbuild@>=0.27.3 <0.28.1": ">=0.28.1",
+      "sharp": "^0.35.4",
+      "svgo": "^4.1.0",
+      "js-yaml": "^4.3.2"
     }
   }
 }