#158 security: fix Dependabot alerts in dompurify, astro, and @babel/core

Fixes ENG-5625.

Clears 23 of the 24 open Dependabot alerts (0 high, 17 medium, 7 low) by bumping three packages:

Package	From	To	Alerts closed
dompurify	3.3.1 (session-ui) / 3.4.11 (ui, catalog)	3.4.13	19 of 20
astro	6.4.8	7.1.0	3
@babel/core	7.28.4	7.29.6	1

The remaining alert, dompurify CVE-2026-65901 (low), has no fixed release — Vanta marks it not fixable, so it needs an exception there rather than a code change.

astro 7 migration notes

packages/web moves to astro 7.1.0 (CVE-2026-73422 requires >= 7.1.0), which drags the integrations along:

• @astrojs/starlight 0.40.0 → 0.41.7 (the astro-7-compatible line; 0.41.8+ is still inside the bunfig minimumReleaseAge window)
• @astrojs/solid-js 6.0.1 → 7.0.2
• @astrojs/cloudflare 13.7.0 → 14.1.7 — deliberately not 14.2.x: 14.2.0 imports beginContentEntryCollection from astro internals, which only exists from astro 7.2.0, despite the 14.2.0 peer range claiming ^7.0.0. The 14.2.x releases that fixed the peer range (^7.2.0) can't pair with astro 7.1.0 at all.
• The root overrides pin for astro/starlight and the toolbeam-docs-theme peer patch are refreshed the same way as the astro 6 migration (#109), so the unmaintained theme keeps deduping onto the site's versions instead of pulling a nested older astro.
• prerenderEnvironment: "node" carries over unchanged — the option still exists with the same workerd default in adapter v14.

The nested @babel/core@7.28.0 pinned by @opentui/solid stays as-is; Dependabot keys these alerts off the package manifests and has never flagged that copy.

Verification

• Full astro build of packages/web: all locales prerender, config schema generated, Pagefind indexed 649 pages, sitemap created
• bun run typecheck + bun test src in packages/ui (9 pass) and packages/session-ui (75 pass — includes the DOMPurify.sanitize/addHook consumer in markdown-cache.tsx)
• Root bun run typecheck: 17/17 tasks pass

nix/hashes.json is left to the post-merge bot that regenerates node_modules hashes, matching previous dependency PRs.

---

Summary by cubic

Bumps dompurify, astro, and @babel/core to clear 23 of the 24 open Dependabot alerts, and moves solid-js to 1.9.15 so the docs site's Solid island satisfies @astrojs/solid-js@7.0.2's peer range. The remaining low-severity dompurify alert has no fixed release and needs a Vanta exception, not a code change.

Migration Notes

• packages/web moves to astro 7.1.0; this brings @astrojs/starlight, @astrojs/solid-js, and @astrojs/cloudflare major bumps (14.1.7 is pinned deliberately, because 14.2.x imports an astro internal that only exists from 7.2.0).
• @astrojs/markdown-remark moves 7.2.0 → 7.2.1 to match astro 7.1.0's exact optional peer.
• solid-js moves 1.9.10 → 1.9.15: the old patch is dropped because solidjs/solid#2046 ships upstream in 1.9.14+.
• A root solid-js override keeps solid a singleton; @opentui/solid, @opentui/keymap, and @solidjs/start pin 1.9.10 and would otherwise grow nested copies.
• The root overrides pin and the toolbeam-docs-theme peer patch are refreshed so the theme still dedupes onto the site's astro/starlight versions.
• prerenderEnvironment: "node" carries over unchanged.
• The nested @babel/core under @opentui/solid stays as-is; Dependabot flags only manifest-declared copies.