The osv-scanner required check (`Secrets, deps, and workflow scan`) fails on main's yarn.lock, ejecting every PR from the merge queue (observed on aws-samples#623). Advisories were published after PR-open scans, so PR-level checks are green while the merge_group re-scan is red. - astro 7.0.5 -> 7.1.3 (docs/package.json). Fixes GHSA-4g3v-8h47-v7g6 (XSS), GHSA-8mv7-9c27-98vc, GHSA-f48w-9m4c-m7f5. NOTE: intentionally 7.1.3, NOT 7.1.0 — 7.1.0 (the version Dependabot aws-samples#631/aws-samples#630 target, and the "fixed" version GHSA-4g3v cites) is flagged malicious by MAL-2026-10726. 7.1.3 is the current `latest` and is past the single poisoned release. - brace-expansion re-resolved within existing ^1.1.7/^2.0.2 ranges: 1.1.15 -> 1.1.16 and 2.1.1 -> 2.1.2 (GHSA-3jxr-9vmj-r5cp). Transitive-only; no resolutions pin needed. Lockfile-only (+ one version string). Verified: `mise run security:deps` exits 0, `mise //docs:build` builds 68 pages clean, `mise run security:retire` clean. Supersedes Dependabot aws-samples#631/aws-samples#630 (which bump to the malicious 7.1.0). Co-authored-by: bgagent <bgagent@noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>