#109 security: bump vulnerable npm dependencies + migrate docs to astro 6

Addresses the batch of npm CVEs flagged for browsercode. Fixes are direct-dependency bumps; the lockfile was regenerated and verified to contain no remaining vulnerable versions of these packages (no risky global library overrides).

CVEs fixed

CVE(s)	Package	Change
CVE-2026-0933	wrangler	4.50.0 → 4.59.2 (+ @cloudflare/vite-plugin 1.15.2 → 1.21.0, which pins the transitive wrangler)
CVE-2026-26996, CVE-2026-27903, CVE-2026-27904	minimatch	10.0.3 → 10.2.5
CVE-2025-58179	@astrojs/cloudflare	12.6.3 → 13.7.0
CVE-2026-44902	@opentelemetry/sdk-node (+ co-versioned OTLP exporters)	0.214.0 → 0.217.0
CVE-2026-48068, CVE-2026-48069	@grpc/grpc-js	1.14.3 → 1.14.4
CVE-2025-64764	astro	5.7.13 → 6.4.8
CVE-2026-50146	astro	→ 6.4.8 (fixed in 6.3.3, no astro 5 backport)
CVE-2026-54299	astro	→ 6.4.8 (fixed in 6.4.6, no astro 5 backport)

Version choices respect the repo's minimumReleaseAge (3 days) supply-chain policy — every bumped version was published ≥ 3 days ago.

Commits

1. security: bump vulnerable npm dependencies — the low-risk in-major bumps (wrangler, minimatch, cloudflare 12.x, otel, grpc, astro 5.15.9). Verified: core packages typecheck clean.
2. security: migrate packages/web to astro 6 — the two remaining astro advisories have no astro 5 backport, so the docs site is upgraded to astro 6.4.8 with the compatible @astrojs/* stack (starlight 0.40, solid-js 6, cloudflare 13, markdown-remark 7.2, check 0.9.9).

Notes on the astro 6 migration

• toolbeam-docs-theme has no astro 6 release. Its Starlight plugin uses only stable APIs, so its peer range is widened via a small patch (patches/toolbeam-docs-theme@0.4.8.patch). astro and @astrojs/starlight are pinned via overrides so the theme's peer resolution dedupes onto the site's astro 6 / starlight 0.40 rather than pulling a nested astro 5.15.9 (which would leave the two CVEs unfixed). Both packages are used only by packages/web, so these overrides are scoped in practice.
• prerenderEnvironment: "node" — @astrojs/cloudflare v13 defaults to prerendering in the workerd runtime, which lacks the Node built-ins (path/fs/url) that Astro/Zod internals import. Setting node keeps the v12 behavior.

Verification

• Full astro build of the docs site passes: all 19 locales prerendered (649 HTML files), Pagefind search index + sitemap generated.
• bun turbo typecheck (core packages) passes.
• Pre-existing, out-of-scope: astro check reports type-only errors in the share feature (opencode/session/* imports with no tsconfig path alias, implicit-any) — unrelated to the astro version and not part of CI.

Note: the pip-starlette and vite/workflow-use advisories in the same batch belong to a different repo (workflow-use), not browsercode.

---

Summary by cubic

Bumps vulnerable npm dependencies and upgrades the docs site to astro 6 to resolve open CVEs. Also aligns the Cloudflare adapter with SST deploy config. Lockfile regenerated; docs build and core type checks pass.

• Dependencies

  • Updated wrangler to 4.59.2 and @cloudflare/vite-plugin to 1.21.0.
  • Updated minimatch to 10.2.5 and @grpc/grpc-js to 1.14.4.
  • Bumped @opentelemetry/sdk-node and OTLP exporters to 0.217.0.
  • Regenerated bun.lock to remove vulnerable transitive versions.

• Migration

  • Upgraded docs (packages/web) to astro 6.4.8 with @astrojs/cloudflare 13.7.0, @astrojs/starlight 0.40.0, @astrojs/solid-js 6.0.1, and @astrojs/markdown-remark 7.2.0; bumped @astrojs/check to 0.9.9.
  • Patched toolbeam-docs-theme@0.4.8 to widen peers for astro 6/Starlight 0.40 and used overrides to avoid a nested astro 5.
  • Cloudflare adapter: forward SST’s Wrangler config via configPath (SST_WRANGLER_PATH) for deploys, and set prerenderEnvironment: "node" to match prior behavior and avoid workerd limits.