security: migrate packages/web to astro 6 (CVE-2026-50146, CVE-2026-54299)

These two astro advisories have no astro 5 backport, so upgrade the docs
site to astro 6.4.8. Ecosystem bumps required for compatibility:

- astro 5.15.9 -> 6.4.8
- @astrojs/cloudflare 12.6.13 -> 13.7.0
- @astrojs/starlight 0.34.3 -> 0.40.0
- @astrojs/solid-js 5.1.0 -> 6.0.1
- @astrojs/markdown-remark 6.3.1 -> 7.2.0
- @astrojs/check 0.9.6 -> 0.9.9

toolbeam-docs-theme has no astro 6 release; its plugin uses only stable
Starlight APIs, so its peer range is widened via a patch (verified by a full
build). astro and @astrojs/starlight are pinned via overrides so the theme's
peer resolution dedupes onto the site's astro 6 / starlight 0.40 instead of
pulling a nested astro 5.15.9 (which would leave the CVEs unfixed); both are
used only by packages/web.

@astrojs/cloudflare v13 prerenders in the workerd runtime by default, which
lacks the Node built-ins (path/fs/url) that Astro/Zod internals import; set
prerenderEnvironment: "node" to keep the v12 behavior. Full `astro build`
passes: all locales prerendered, Pagefind search index and sitemap generated.

Author: sauravpanda

bun.lock

@@ -144,7 +144,9 @@
     "@opentelemetry/core": "2.9.0",
     "@opentelemetry/sdk-trace-base": "2.9.0",
     "@opentelemetry/resources": "2.9.0",
-    "@opentelemetry/sdk-trace-node": "2.9.0"
+    "@opentelemetry/sdk-trace-node": "2.9.0",
+    "astro": "6.4.8",
+    "@astrojs/starlight": "0.40.0"
   },
   "patchedDependencies": {
     "@ff-labs/fff-bun@0.9.3": "patches/@ff-labs%2Ffff-bun@0.9.3.patch",
@@ -159,6 +161,7 @@
     "@tanstack/solid-virtual@3.13.28": "patches/@tanstack%2Fsolid-virtual@3.13.28.patch",
     "@pierre/trees@1.0.0-beta.4": "patches/@pierre%2Ftrees@1.0.0-beta.4.patch",
     "@modelcontextprotocol/sdk@1.29.0": "patches/@modelcontextprotocol%2Fsdk@1.29.0.patch",
-    "@tanstack/virtual-core@3.17.0": "patches/@tanstack%2Fvirtual-core@3.17.0.patch"
+    "@tanstack/virtual-core@3.17.0": "patches/@tanstack%2Fvirtual-core@3.17.0.patch",
+    "toolbeam-docs-theme@0.4.8": "patches/toolbeam-docs-theme@0.4.8.patch"
   }
 }

package.json

@@ -2,6 +2,8 @@
 dist/
 # generated types
 .astro/
+# cloudflare adapter / miniflare state
+.wrangler/
 
 # dependencies
 node_modules/

packages/web/.gitignore

@@ -16,6 +16,10 @@ export default defineConfig({
   output: "server",
   adapter: cloudflare({
     imageService: "passthrough",
+    // @astrojs/cloudflare v13 defaults to prerendering in the workerd runtime,
+    // which lacks Node built-ins (path/fs/url) that Astro/Zod internals import.
+    // Prerender in Node instead, matching the previous (v12) behavior.
+    prerenderEnvironment: "node",
   }),
   devToolbar: {
     enabled: false,

packages/web/astro.config.mjs

@@ -12,16 +12,16 @@
     "astro": "astro"
   },
   "dependencies": {
-    "@astrojs/cloudflare": "12.6.13",
-    "@astrojs/markdown-remark": "6.3.1",
-    "@astrojs/solid-js": "5.1.0",
-    "@astrojs/starlight": "0.34.3",
+    "@astrojs/cloudflare": "13.7.0",
+    "@astrojs/markdown-remark": "7.2.0",
+    "@astrojs/solid-js": "6.0.1",
+    "@astrojs/starlight": "0.40.0",
     "@fontsource/ibm-plex-mono": "5.2.5",
     "@shikijs/transformers": "3.20.0",
     "@solid-primitives/resize-observer": "2.1.5",
     "@types/luxon": "catalog:",
     "ai": "catalog:",
-    "astro": "5.15.9",
+    "astro": "6.4.8",
     "diff": "catalog:",
     "js-base64": "3.7.7",
     "lang-map": "0.4.0",
@@ -38,7 +38,7 @@
   "devDependencies": {
     "@browser-use/browsercode-core": "workspace:*",
     "@types/node": "catalog:",
-    "@astrojs/check": "0.9.6",
+    "@astrojs/check": "0.9.9",
     "typescript": "catalog:"
   }
 }

packages/web/package.json

@@ -0,0 +1,15 @@
+diff --git a/package.json b/package.json
+index 04cb0f7f1265123ea3319a78527c42155fca7fbf..3d3385ff2131cf9975d8d2619715d08cc771a9ce 100644
+--- a/package.json
++++ b/package.json
+@@ -24,7 +24,7 @@
+     "typescript": "^5.5.4"
+   },
+   "peerDependencies": {
+-    "@astrojs/starlight": "^0.34.3",
+-    "astro": "^5.7.13"
++    "@astrojs/starlight": "^0.34.3 || ^0.40.0",
++    "astro": "^5.7.13 || ^6.4.5"
+   }
+ }
+\ No newline at end of file