chore(deps): bump npm dependencies

[Totara-thib]

Applies the Dependabot minor-and-patch group (#388) and the @keystatic/astro major (#361) on top of the advisory fixes from #389.

Supersedes #388 and #361.

Why these are combined

Both Dependabot PRs edit package.json and package-lock.json, and both predate the advisory fixes in #389, so each conflicts with main and with the other. Landing them separately would mean three lockfile regenerations and three conflict resolutions to reach the same tree. This is one regeneration from the registry instead.

Dependencies

Package	From	To
@astrojs/react	6.0.4	6.0.5
@astrojs/sitemap	3.7.3	3.7.4
@astrojs/vercel	11.0.7	11.0.10
@keystatic/astro	5.2.0	6.0.0
@keystatic/core	0.6.8	0.6.9
@types/react	19.2.18	19.3.0
@types/react-dom	19.2.4	19.3.0
astro-auto-import	0.5.2	0.6.0
astro-expressive-code	0.44.1	0.44.2
astro-seo	1.1.0	1.2.0
react, react-dom	19.2.8	19.3.0

Dev dependencies: eslint 10.9.0 to 10.10.0 (both the dependency and the matching overrides pin, as Dependabot proposed), globals 17.11.0 to 17.12.0, typescript-eslint 8.67.0 to 8.70.0.

@astrojs/markdown-remark is already at ^7.3.1 on main via #389, and astro stays at 7.3.3: this group does not touch either.

On the @keystatic/astro major

Low risk. The 6.0.0 peer range is astro "5 || 6 || 7" against 5.2.0's "2 || 3 || 4 || 5 || 6 || 7", so the major only drops astro 2/3/4 support. This repository already runs astro 7.

Verification

• npx -y npm@10 ci --dry-run in sync
• npm audit --audit-level=moderate and npm audit --omit=dev --audit-level=high both report 0 vulnerabilities
• npm run lint clean, 0 errors (the same 15 pre-existing import-sort warnings; no source files are touched by this PR)
• npm run build green, same 291 pages and same pagefind index (20 pages, 2987 words) as main
• Home, /blog, /docs/cli/installation and the provider-tab docs pages render with no console errors

Lockfile regenerated from the registry with npm 10 and no node_modules present, per CLAUDE.md.

Note on /keystatic

While verifying this branch the Keystatic admin was blank in local dev. That turned out to be pre-existing on main and unrelated to these bumps: it reproduces with @keystatic/astro 5.2.0 and is fixed separately in #392.