Upgrade Astro to 7.4 and add basic security settings

.github/copilot-instructions.md

@@ -18,7 +18,7 @@ Static site built with [Astro](https://astro.build/) and published to GitHub Pag
 
 ## Local development
 
-Requires Node 20 or newer.
+Requires Node 22.23.4 or newer.
 
 ```bash
 npm install     # first time only

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      npm:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]

.github/workflows/deploy.yml

@@ -30,7 +30,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
           cache: npm
       - run: npm ci
       # The badge generator reads each module's CI status from the GitHub Actions

.github/workflows/pr-build.yml

@@ -0,0 +1,26 @@
+name: Build check
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npx playwright install --with-deps chromium
+      # The Playwright web server builds the site, so this also checks the build.
+      - run: npm test
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -48,7 +48,7 @@ Editing guidance for contributors and coding assistants lives in [`.github/copil
 
 ## Local development
 
-Requires [Node](https://nodejs.org/) 20 or newer.
+Requires [Node](https://nodejs.org/) 22.23.4 or newer.
 
 ```sh
 npm install        # first time only

astro.config.mjs

@@ -23,6 +23,10 @@ const licenseRouteGuard = {
   },
 };
 
+// CSS for Safari 14+ as well: Vite 8 targets Safari 16.4+ by default and rewrites
+// max-width media queries into range syntax, which older Safari ignores.
+const cssTarget = ['chrome87', 'edge88', 'firefox78', 'safari14'];
+
 // Public site served at the apex domain (CNAME -> proteus-framework.org).
 // No base path: the site lives at the domain root.
 export default defineConfig({
@@ -38,5 +42,6 @@ export default defineConfig({
   },
   vite: {
     plugins: [licenseRouteGuard],
+    build: { cssTarget },
   },
 });