Upgrade Astro to 7.3.5 to fix Sharp/libheif RCE advisory

Astro < 7.2.8 bundles a Sharp (0.34.x) whose libheif can be exploited via
a malicious AVIF image. There is no 5.x backport, so upgrade to Astro 7,
which pulls in sharp 0.35.5.

Astro 7 follow-ups:
- Node 20 -> 22 in the Dockerfile and deploy workflow (Astro 7 needs >= 22.12)
- Add @astrojs/markdown-remark and pass remark plugins via unified()
- Set compressHTML: true to keep Astro 5's whitespace handling
- Drop the missing owl.video.play.png reference and IE star hacks, which
  the new Vite/LightningCSS pipeline rejects

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: aneesas

.github/workflows/deploy.yml

@@ -27,7 +27,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
 
       - run: npm ci

Dockerfile

@@ -1,6 +1,6 @@
 # Single image used for both local dev (astro dev) and producing the static
 # build (astro build). Node lives only in here — the host needs just Docker.
-FROM node:20-alpine
+FROM node:22-alpine
 
 WORKDIR /app
 

astro.config.mjs

@@ -1,5 +1,6 @@
 // @ts-check
 import { defineConfig } from 'astro/config';
+import { unified } from '@astrojs/markdown-remark';
 import remarkSmartypants from 'remark-smartypants';
 import remarkImageParagraphs from './src/lib/remark-image-paragraphs.ts';
 import remarkReferences from './src/lib/remark-references.ts';
@@ -9,6 +10,9 @@ import remarkReferences from './src/lib/remark-references.ts';
 export default defineConfig({
   site: 'https://acl.mit.edu',
   trailingSlash: 'ignore',
+  // Astro 7 defaults to JSX whitespace rules, which drop the spaces between
+  // inline elements that the templates rely on; keep the lossless compression.
+  compressHTML: true,
   build: {
     // Keep the old site's URLs: `people/index.astro` -> /people/index.html,
     // `people/[kerberos].astro` -> /people/<kerberos>.html (served at /people/<kerberos>).
@@ -17,8 +21,10 @@ export default defineConfig({
   markdown: {
     // Typographic quotes and dashes as on the old (kramdown) site: `--` is an
     // en dash, `---` an em dash.
-    smartypants: false,
-    remarkPlugins: [[/** @type {any} */ (remarkSmartypants), { dashes: 'oldschool' }], remarkReferences, remarkImageParagraphs],
+    processor: unified({
+      smartypants: false,
+      remarkPlugins: [[/** @type {any} */ (remarkSmartypants), { dashes: 'oldschool' }], remarkReferences, remarkImageParagraphs],
+    }),
     syntaxHighlight: 'shiki',
     shikiConfig: { theme: 'github-light' },
   },