fix(deps): resolve npm security advisories

[chaliy]

What changed

Updates vulnerable npm dependencies in the JS package and website to patched versions. Also restores the release workflow invariant that every publish workflow, including the website publisher, is dispatched from the verified release tag.

Why

Dependabot reported eight open advisories across Astro, js-yaml, tar, and brace-expansion. A fresh audit also found vulnerable fast-uri, svgo, and sharp versions. The existing pre-PR release regression test additionally exposed the missing website publish dispatch.

Before / After

Before:

• GitHub reported 8 open Dependabot alerts on the default branch.
• Fresh site audit reported 4 additional high-severity transitive findings.
• just pre-pr failed because publish-web.yml was not dispatched.

After:

• Both package audits report No known vulnerabilities found.
• Astro check and production build pass, including all post-build verification.
• JS TypeScript check and all 520 AVA tests pass.
• just pre-pr passes, including clippy, Rust tests, workflow tests, and cargo-vet.

Risk

• Low
• Dependency updates remain within compatible release lines, except sharp moves to the patched 0.35 line and is validated by the full Astro production build.
• Release dispatch change uses the same verified tag and mechanism as the other publish workflows.

Checklist

• Existing tests cover the dependency and release workflow changes
• Backward compatibility considered
• Security audits report no known vulnerabilities

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	d3d62ce	Commit Preview URL Branch Preview URL	Jul 22 2026, 08:50 PM