security: clear high-severity alerts (svgo 4.0.2, sharp 0.35.x)

[avifenesh]

Summary

Clears both open high-severity Dependabot alerts on this repo.

Package	Advisory	Was	Now
svgo	GHSA-2p49-hgcm-8545 — removeScripts plugin leaves some executable scripts intact	4.0.x < 4.0.2	4.0.2
sharp	GHSA-f88m-g3jw-g9cj — inherited libvips CVE-2026-33327 / CVE-2026-33328	0.34.5	0.35.3

Why an override for sharp

sharp is transitive — astro declares sharp: ^0.34.0, so a plain lockfile bump can't cross into 0.35.x. npm audit wanted to resolve this by moving astro 6.4 → 7.1.3, a major bump with real breaking-change surface, purely to satisfy a transitive image-processing dep.

Instead this pins sharp via overrides (the repo already uses that pattern for esbuild). Astro stays on 6.4.x, and sharp lands on a patched libvips.

"overrides": {
  "esbuild": "^0.28.1",
  "sharp": "^0.35.0"
}

sharp@0.35 requires Node >=20.9.0 — fine for this project.

Verification

• npm install — clean
• npm run build (astro build) — succeeds, 4 pages built, no warnings from the override
• npm audit — 0 high / 0 critical remaining (1 moderate left: astro XSS advisories that need astro 7, tracked separately)

Out of scope

The remaining open astro alerts (GHSA-f48w-9m4c-m7f5 medium, GHSA-4g3v-8h47-v7g6 medium, GHSA-7pw4-f3q4-r2p2 low) all require the astro 7 major. Worth doing deliberately as its own PR with a real smoke pass, not bundled into a security patch.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.