[bpamiri]

Closes #4359

Summary

Every static site builds and deploys on Astro 6.4.6, but its package.json said "astro": "^7.2.8". That's because the root web/package.json override pnpm.overrides.astro: "^6.3.1" (from #2523) rewrites every astro request in the workspace to ^6.3.1.

The ^7.2.8 came from #3536, which edited the site manifests; the root override kept every site on 6.4.6. pnpm install --frozen-lockfile passes because pnpm checks the lockfile against the specifiers after overrides: the lockfile records specifier: ^6.3.1 / version: 6.4.6.

This PR makes the manifests say what's actually installed:

• web/sites/{landing,blog,guides,api,packages}/package.json: astro ^7.2.8 → ^6.3.1, matching the override.
• web/packages/ui/package.json: the astro peer range ^5.0.0 → ^6.0.0.

The override stays. Moving to Astro 7 is a real upgrade: Starlight 0.42 requires astro ^7.2.10, and the override has to be removed. It belongs in its own PR with a full build of all five sites.

Verification

• pnpm install --frozen-lockfile passes, and pnpm install --lockfile-only leaves web/pnpm-lock.yaml byte-identical. Nothing resolves differently.
• sites/guides/node_modules/astro is still 6.4.6.
• pnpm build (all five sites): 5/5 complete.

Note: the repository has no .github/dependabot.yml. A future automated bump can re-edit these specifiers the same way while the override is in place; configuring dependabot is out of scope here.

🤖 Generated with Claude Code

[bpamiri]

rev1-r3 review @ 07106d4: APPROVE in substance (final sign-off after PR CI)

• The declared ranges now match what actually builds. Root web/package.json has pnpm.overrides.astro: "^6.3.1", and pnpm-lock.yaml already records every site importer's astro as specifier: ^6.3.1 / version: 6.4.6 (5 importers). The ^7.2.8 in the five site package.jsons, from dependabot's build(deps): bump astro from 6.4.6 to 7.2.8 in /web #3536 bump, was never what pnpm resolved. Changing them to ^6.3.1 makes each manifest match its lockfile entry, which is why the lockfile is byte-identical and the frozen install passes. @wheels-dev/ui's peer ^5.0.0 → ^6.0.0 matches the Astro 6.4.6 it's actually used with, and removes the peer-range mismatch.
• No lockfile change. Nothing about the installed tree changes; the PR only makes the manifests truthful.

Not blocking: there's no .github/dependabot.yml in the repo, so whatever opened #3536 (security or version updates from the repo settings) can propose the same ^7 bump again. Since the override keeps resolving 6.x, such a PR would again change nothing real but reintroduce the mismatch. Either add a dependabot config that ignores astro major updates under /web, or close those PRs on sight until the move to Astro 7 is deliberate (which also needs Starlight 0.41 or later, as #4356 notes).

[bpamiri]

rev1-r3 review @ 07106d4: APPROVE (final; PR CI checked)

PR CI on this head: 20 pass, 3 skipped, 0 failing or pending, including the five site builds and the frozen install against the unchanged lockfile. The change is as I reviewed it: the manifests now match the lockfile's override-resolved ^6.3.1 / 6.4.6. (#4362's Astro 7 move follows this PR, by design.)