Dependencies current: npm audit 0 (was 7, six of them high)

nodemailer and basic-ftp are only fixed in their next major, so this
takes both, along with argon2 0.45, ssh2-sftp-client 12, archiver 8,
@astrojs/react 7 and the minor bumps.

- archiver 8 has no default export any more, only `ZipArchive`. Our own
  `src/types/archiver.d.ts` still declared the old default, so `tsc` would
  have stayed green while every ZIP download threw at runtime. The local
  declaration is gone; `@types/archiver` 8 matches the real API now.
- nodemailer 10 ships its own types; `@types/nodemailer` is gone.
- Existing argon2 hashes still verify (hash made with 0.41, verified
  with 0.45).
- basic-ftp 6 no longer silently redirects the data connection when an
  FTP server behind NAT announces its private address. That is the
  library's deliberate secure default. If a delivery target that worked
  before fails now, press "Test connection" — the error names the cause.
- `baseUrl` is out of tsconfig.json (TypeScript 7 removed it; the `@/`
  alias was never used).
- engines: Node >= 22.12, which pg-boss and @astrojs/react now require.

Deliberately not taken: pg-boss 12 cannot migrate the v10 queue schema
in place, and TypeScript 7 is a toolchain switch with no security gain.
Both get their own change.

package.json

@@ -26,7 +26,7 @@
   ],
   "type": "module",
   "engines": {
-    "node": ">=22.6"
+    "node": ">=22.12"
   },
   "scripts": {
     "dev": "astro dev",
@@ -38,32 +38,32 @@
     "scan": "node scripts/secret-scan.mjs"
   },
   "dependencies": {
-    "@astrojs/node": "^11.1.5",
-    "@astrojs/react": "^6.0.5",
-    "@aws-sdk/client-s3": "^3.700.0",
+    "@astrojs/node": "^11.1.7",
+    "@astrojs/react": "^7.0.1",
+    "@aws-sdk/client-s3": "^3.1149.0",
     "@fontsource/space-grotesk": "^5.1.0",
     "@fontsource/space-mono": "^5.1.0",
-    "archiver": "^7.0.1",
-    "argon2": "^0.41.1",
-    "astro": "^7.3.2",
-    "basic-ftp": "^5.0.5",
-    "grammy": "^1.30.0",
+    "archiver": "^8.0.0",
+    "argon2": "^0.45.1",
+    "astro": "^7.3.8",
+    "basic-ftp": "^6.2.3",
+    "grammy": "^1.46.0",
     "heic-convert": "^2.1.0",
-    "nodemailer": "^9.1.0",
+    "nodemailer": "^10.0.16",
     "pdf-lib": "^1.17.1",
-    "pg": "^8.13.1",
+    "pg": "^8.23.1",
     "pg-boss": "^10.1.5",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
-    "sharp": "^0.35.4",
-    "ssh2-sftp-client": "^11.0.0"
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
+    "sharp": "^0.35.5",
+    "ssh2-sftp-client": "^12.1.1"
   },
   "devDependencies": {
-    "@types/node": "^26.5.1",
-    "@types/nodemailer": "^8.0.1",
-    "@types/pg": "^8.11.10",
-    "@types/react": "^19.0.0",
-    "@types/react-dom": "^19.0.0",
+    "@types/archiver": "^8.0.0",
+    "@types/node": "^26.6.5",
+    "@types/pg": "^8.23.1",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
     "@types/ssh2-sftp-client": "^9.0.6",
     "typescript": "^5.7.2"
   }