fix(marketing): update Astro image dependency chain

[rynfar]

The marketing workspace resolves Astro 7.0.3, which is below the patched release for GHSA-26w7-cxv4-gfx2. This PR raises Astro's minimum to 7.2.8 and Sharp to the required 0.35.4. The lockfile resolves Astro 7.3.4.

Pylon's marketing build is static. Its only getImage call optimizes a repository-owned WebP screenshot to WebP; I found no path that accepts an untrusted AVIF image, which is the advisory's exploit condition. The upgrade removes the vulnerable dependency regardless, without claiming a demonstrated Pylon RCE path.

Validation in an isolated worktree: resolved Astro 7.3.4 and Sharp 0.35.4; marketing typecheck, complete static build including four optimized screenshot outputs, 17 focused marketing tests, server typecheck for a changed optional Zod peer context, formatting, and diff check pass. A read-only pnpm audit comparison reports 132 to 122 advisories, including critical 1 to 0; that count is a dependency snapshot, not a claim of full security review or exploitability. No deployment or live site interaction was performed.

This marketing runtime fix is separate from #771, which adopts the compatible desktop/asar parts of upstream T3 #12417 and only bumps @astrojs/check. Rebase may be needed if #771 lands first.

Model: GPT-6 Sol (low reasoning). Harness: Pylon Codex.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pylon-marketing	Ready	Preview	Sep 24, 2026 9:15am UTC

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.0 KiB	14.0 KiB	−26 B (−0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	+5 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.7 KiB	−31 B (−0.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.0 KiB	58.0 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	10	9	−1 (−10.0%)	21	✅
Claude	Total thread wire	14.0 KiB	14.0 KiB	+3 B (+0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	−7 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.8 KiB	+10 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.9 KiB	58.9 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 7ed3f71 · PR result: 75c85f7 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.7 KiB
• Claude decoded thread snapshot: 116.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.