v1.1.35 — transitive CVE overrides, Astro 7, dependency refresh

Security

• Four high-severity CVEs closed in the shipped dependency tree — js-yaml (GHSA-52cp-r559-cp3m), svgo (GHSA-2p49-hgcm-8545), sharp (GHSA-f88m-g3jw-g9cj), postcss (GHSA-r28c-9q8g-f849).
• All four arrive transitively through astro, @astrojs/mdx and @tailwindcss/vite; each is pinned to its patched range via pnpm.overrides.
• The pnpm audit --prod --audit-level=high gate had been failing on main and passes again.

Fixed

• TV sizes in the hardware checklist now use U+2033 (double prime) instead of an ambiguous straight quote — the correct character for inches.
• The USB controllers page heading's opening quote no longer renders as a closing quote.

Dependencies

• Astro 6.4.8 → 7.1.5 and @astrojs/mdx 6.0.3 → 7.0.5, which also moves vite 7 → 8.
• Verified against a baseline build: identical output tree (272 files, 54 HTML pages, 34 byte-identical OG images), scoped-style hashes resolve.
• Remaining deltas are the generator meta tag, regenerated data-astro-cid hashes, and tighter minification.
• TypeScript held at 6.0.3 — the 7.x native compiler drops the programmatic Language Service API astro check needs (withastro/roadmap#1321).
• Minor/patch group bump across 11 packages: satori, tailwindcss, @tailwindcss/vite, three @fontsource families, marked, isomorphic-dompurify, prettier, prettier-plugin-tailwindcss, @astrojs/check.

CI

• actions/setup-node v6 → v7 in the CI and deploy workflows.