fix(deps): bump astro to 7.1.3 + re-resolve brace-expansion to clear osv-scanner (#636)

[scottschreckengaust]

What & why

The osv-scanner required check (Secrets, deps, and workflow scan → Dependency scan (osv-scanner))
fails on main's yarn.lock, which ejects every PR from the merge queue — the merge_group
re-scan runs against the latest main and fails any queued PR. Observed on #623, which is otherwise
approved + CLEAN but kept getting removed from the queue by github-merge-queue[bot].

These advisories were published after the affected PRs' PR-open scans, so PR-level checks are
green while the merge_group re-scan is red.

Closes #636.

Changes (lockfile-only + one version string)

• astro 7.0.5 → 7.1.3 (docs/package.json). Fixes GHSA-4g3v-8h47-v7g6 (reflected XSS),
  GHSA-8mv7-9c27-98vc, GHSA-f48w-9m4c-m7f5.
  • ⚠️ Intentionally 7.1.3, not 7.1.0. GHSA-4g3v lists its fix as 7.1.0, and Dependabot
    chore(deps): npm: bump astro from 7.0.5 to 7.1.0 #631 / chore(deps): npm: bump astro from 7.0.5 to 7.1.0 in /docs #630 bump to exactly that — but 7.1.0 is flagged malicious by
    MAL-2026-10726 (published 2026-07-16, affects
    only 7.1.0). 7.1.3 is the current latest and is past the single poisoned release.
• brace-expansion re-resolved within the existing ^1.1.7 / ^2.0.2 ranges:
  1.1.15 → 1.1.16 and 2.1.1 → 2.1.2 (GHSA-3jxr-9vmj-r5cp, CVSS 7.7). Transitive-only, so no
  resolutions pin was needed — the caret ranges already permit the patched versions.

Verification

• mise run security:deps (osv-scanner, exact CI command) → No issues found (exit 0).
• mise //docs:build → 68 pages built clean under astro 7.1.3.
• mise run security:retire → clean.
• Range-scoped gitleaks (origin/main..HEAD) → no leaks (the pre-push full-history hit is
  pre-existing history on other branches, unrelated to this diff).

Supersedes

Dependabot #631 and #630 (both bump astro to the malicious 7.1.0) — close as superseded
once this lands.

[isadeks]

Approving — verified independently.

Correct fix, correctly scoped. Diff is lockfile-only + one version string (docs/package.json + yarn.lock), no code touched:

• astro 7.0.5 → 7.1.3 — clears the three XSS advisories (GHSA-4g3v-8h47-v7g6 / -8mv7-9c27-98vc / -f48w-9m4c-m7f5), and deliberately 7.1.3, not the 7.1.0 Dependabot #631/#630 targeted — 7.1.0 is flagged malicious by MAL-2026-10726 (confirmed: 7.1.0 returns that advisory in OSV, 7.1.3 is clean).
• brace-expansion 1.1.15 → 1.1.16 + 2.1.1 → 2.1.2 (GHSA-3jxr-9vmj-r5cp) — re-resolved within the existing caret ranges, no resolutions pin needed. Both patched versions confirmed clean in OSV.

All 8 checks green, incl. the previously-failing Secrets, deps, and workflow scan — osv-scanner logs "No issues found" (exit 0). This clears the merge_group re-scan that was ejecting approved PRs from the queue, and the same red check on #616 and other open PRs.

Superseding #631/#630 is the right call — both bump into the poisoned 7.1.0.