chore(deps): dependency upgrades

[donfear]

📦 Dependency upgrades

Scanned 31 packages — 13 unique upgrade(s) (14 across workspaces) (3 with a major available, 1 with known vulnerabilities).

✅ Applied in this PR

• @astrojs/check ^0.9.9 → ^0.9.10 (devDependencies)
• @astrojs/markdown-satteri ^0.3.4 → ^0.3.5 (devDependencies)
• @biomejs/biome ^2.5.5 → ^2.5.7 (devDependencies)
• @iconify-json/lucide ^1.2.118 → ^1.2.122 (dependencies)
• @iconify-json/simple-icons ^1.2.91 → ^1.2.93 (dependencies)
• @types/semver ^7.7.1 → ^7.8.0 (devDependencies)
• astro ^7.1.3 → ^7.2.0 (dependencies)
• dependency-cruiser ^18.1.0 → ^18.1.1 (devDependencies)
• marked ^18.0.7 → ^18.0.9 (devDependencies)
• undici ^8.8.0 → ^8.10.0 (dependencies)

Updates

Package	Current	→ In-range	Latest	Type	Applied	Major?	Security
@astrojs/check	^0.9.9	^0.9.10	0.9.10	devDependencies	✅	—	—
@astrojs/markdown-satteri	^0.3.4	^0.3.5	0.3.5	devDependencies	✅	—	—
@biomejs/biome	^2.5.5	^2.5.7	2.5.7	devDependencies	✅	—	—
@iconify-json/lucide	^1.2.118	^1.2.122	1.2.122	dependencies	✅	—	—
@iconify-json/simple-icons	^1.2.91	^1.2.93	1.2.93	dependencies	✅	—	—
@types/node	^25.9.5	^^25.9.5	26.2.0	devDependencies	—	⚠️ yes	—
@types/semver	^7.7.1	^7.8.0	7.8.0	devDependencies	✅	—	—
astro	^7.1.3	^7.2.0	7.2.0	dependencies	✅	—	—
chalk	^5.6.2	^^5.6.2	6.0.0	dependencies	—	⚠️ yes	—
dependency-cruiser	^18.1.0	^18.1.1	18.1.1	devDependencies	✅	—	—
marked	^18.0.7	^18.0.9	18.0.9	devDependencies	✅	—	—
typescript	^6.0.3	^^6.0.3	7.0.2	devDependencies	—	⚠️ yes	—
undici	^8.8.0	^8.10.0	8.10.0	dependencies	✅	—	🟢 fixed by in-range bump

🔒 Security

• undici — 5 advisory(ies), highest 🔴 high — 🟢 fixed by in-range bump
  • undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives (🔴 high, affects >=8.0.0 <8.9.0) — cleared by in-range bump
  • undici vulnerable to downstream response desynchronization via retry interceptor (🟠 moderate, affects >=8.0.0 <8.9.0) — cleared by in-range bump
  • undici vulnerable to CRLF Injection via blob-like body 'type' property (🟠 moderate, affects >=8.0.0 <8.9.0) — cleared by in-range bump
  • undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives (🟠 moderate, affects >=8.0.0 <8.9.0) — cleared by in-range bump
  • undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields (🟠 moderate, affects >=8.0.0 <8.9.0) — cleared by in-range bump

⏭️ Major updates available (not applied)

A new major version exists beyond the in-range bump above. Under the default minor policy the major jump is not applied — review and bump deliberately:

• @types/node (current ^25.9.5) → 26.2.0 (devDependencies)
• chalk (current ^5.6.2) → 6.0.0 (dependencies)
• typescript (current ^6.0.3) → 7.0.2 (devDependencies)

---

🤖 Opened by inup. Re-runs update this same PR.