[Security] Astro SSRF/XSS advisories require breaking major bump (^5 → 6.4.6) in templates/astro

[PAMulligan]

Summary

During the Wk 2 dependency + security sweep, Dependabot reported multiple High-severity Astro advisories (SSRF / XSS) affecting templates/astro/. The patched version is Astro 6.4.6, but the template currently pins Astro ^5.18.2. Resolving these advisories requires a major version bump (5 -> 6), which is a breaking change and should not be applied as part of a routine sweep.

Why this was not auto-fixed in the sweep

• The fix crosses a major version boundary (Astro 5 -> 6), so it cannot be treated as a safe in-range bump.
• • templates/astro/ has no lockfile, so Dependabot cannot open an automated PR for it.
• • • Astro 6.4.6 is a brand-new 2026 release and is likely within the minimumReleaseAge cooldown window the sweep is required to honor.

Proposed work

• Add a lockfile to templates/astro/ so Dependabot can track it.
• - [ ] Plan and test the Astro 5 -> 6 migration (review Astro 6 migration guide / breaking changes).
• - [ ] Bump Astro to a patched version that resolves the SSRF/XSS advisories.
• - [ ] Verify the Astro template still generates correctly through the conversion pipeline.
• - [ ] Confirm CI green and the Stryker mutation gate still passes.

Notes

• Hold until the dependency is past the minimumReleaseAge threshold.
• • Surfaced during the weekly PMDS dependency + security sweep (Wk 2).