chore(deps): bump vulnerable transitives and pin malicious @mistralai/mistralai (#96)

* chore(deps): bump vulnerable transitive deps and pin malicious @mistralai/mistralai

`Security Audit` (osv-scanner) on PRs has been failing with 39
vulnerabilities (1 Critical, 15 High, 20 Medium, 2 Low, 1 Unknown)
across 13 packages — all pre-existing on main, disclosed after the last
main CI run.

- Ran `bun update` to pull in-range patches for `axios`, `basic-ftp`,
  `hono`, `@hono/node-server`, and other direct deps.
- Added overrides to force vulnerable transitives to fixed versions:
  `@protobufjs/utf8`, `devalue`, `fast-uri`, `fast-xml-builder`,
  `fast-xml-parser`, `ip-address`, `postcss`, `protobufjs`, and the
  already-existing `axios`/`hono`/`basic-ftp` overrides.
- Pinned `@mistralai/mistralai` to `1.15.1` (was `1.14.1`, flagged
  malicious — MAL-2026-3432, no upstream fix; 1.14.1 is pulled in
  transitively via `@mariozechner/pi-ai@0.57.1`). Kept within the 1.x
  range to avoid breaking pi-ai's consumer code.

Remaining flagged: `astro@5.18.1` (apps/web). Requires a major bump to
v6 — deferred to a separate PR.

Unblocks #94 and #95.

* chore(deps): bump astro 5→6, ignore overbroad MAL-2026-3432 advisory

Continues unblocking Security Audit on PRs #94 and #95.

- Bumped `astro` (`^5.9.4 → ^6.3.3`), `@astrojs/mdx` (`^4.3.0 → ^5.0.6`),
  `@astrojs/sitemap`, and `@astrojs/check` in `apps/web`. Fixes
  `GHSA-j687-52p2-xcff` and `GHSA-xr5h-phrj-8vxv`. Build, type-check,
  and tests pass.
- Added `osv-scanner.toml` ignoring `MAL-2026-3432`. The OSV advisory's
  SEMVER range covers *all* versions of `@mistralai/mistralai` (no fixed
  event), but the confirmed-malicious releases per the advisory's own
  `versions` list are only `2.2.2`, `2.2.3`, `2.2.4`. We pin `1.15.1`
  via override, which is outside that set. Latest `pi-ai` (0.73.1)
  pulls `^2.2.0` — bumping would be *worse*. Revisit when the OSV range
  narrows or `pi-ai` drops the dep.
- Wired `--config=osv-scanner.toml` into the CI scan args.

* ci: pin Node 22 for astro 6 compatibility

Astro 6 requires Node `>=22.12.0`. GitHub runners default to Node 20,
which now breaks `apps/web` build / test / type-check. Add
`actions/setup-node@v5` with `node-version: "22"` to the typecheck,
build, and test jobs so astro picks up a supported runtime.

`lockfile` and `actions-lint` jobs don't run application code and stay
on the default runtime.

Author: iamladi

.github/workflows/ci.yml

@@ -36,6 +36,9 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: "22"
       - uses: oven-sh/setup-bun@v2
       - uses: actions/cache@v5
         with:
@@ -65,6 +68,9 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: "22"
       - uses: oven-sh/setup-bun@v2
       - uses: actions/cache@v5
         with:
@@ -88,6 +94,9 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: "22"
       - uses: oven-sh/setup-bun@v2
       - uses: actions/cache@v5
         with:
@@ -149,4 +158,5 @@ jobs:
       - uses: google/osv-scanner-action/osv-scanner-action@v2.3.3
         with:
           scan-args: |-
+            --config=osv-scanner.toml
             --lockfile=bun.lock

apps/web/package.json

@@ -14,15 +14,15 @@
 		"format:astro": "prettier --write 'src/**/*.astro'"
 	},
 	"dependencies": {
-		"astro": "^5.9.4",
-		"@astrojs/mdx": "^4.3.0",
-		"@astrojs/sitemap": "^3.3.1",
+		"astro": "^6.3.3",
+		"@astrojs/mdx": "^5.0.6",
+		"@astrojs/sitemap": "^3.7.2",
 		"tailwindcss": "^4.1.10",
 		"@tailwindcss/vite": "^4.1.10",
 		"sharp": "^0.33.5"
 	},
 	"devDependencies": {
-		"@astrojs/check": "^0.9.8",
+		"@astrojs/check": "^0.9.9",
 		"typescript": "^5.9.3",
 		"vitest": "^4.0.18",
 		"prettier": "^3.5.3",