chore: merge main into rewrite/main (astro 7, website dependency bumps)

Brings #1038 and the release commit that followed it onto the sync branch, so
the guard the site change closes is closed here too rather than carried as a
branch difference. No conflicts.

Author: chappie-daemon

.changeset/astro-7-website.md

@@ -0,0 +1,8 @@
+---
+---
+
+fix(deps): astro 7.4.4 and sharp 0.35.5 in website/site
+
+No published package changes: `website/site` is a private workspace package and
+is not part of the release set, so this changeset is empty on purpose. The bump
+closes a critical advisory in astro (< 7.2.8) and three highs in astro and sharp.

.changeset/knex-3-2-9-security.md

@@ -1,47 +1,48 @@
 {
-    "$schema": "https://unpkg.com/knip@2/schema.json",
-    "workspaces": {
-        ".": {
-            "entry": [
-                "src/index.ts!",
-                "src/import-events.ts!",
-                "src/cli/index.ts!",
-                "src/scripts/benchmark-queries.ts!",
-                "knexfile.js!"
-            ],
-            "project": [
-                "src/**/*.ts!"
-            ],
-            "ignoreDependencies": [
-                "lzma-native"
-            ],
-            "ignore": [
-                ".nostr/**",
-                "src/utils/relay-probe/**"
-            ],
-            "commitlint": false,
-            "eslint": false,
-            "github-actions": false,
-            "husky": false,
-            "mocha": false,
-            "nyc": false,
-            "semantic-release": false
-        },
-        "website/site": {
-            "entry": [
-                "astro.config.mjs",
-                "src/**/*.{astro,ts,mjs}",
-                "scripts/*.mjs",
-                "worker/**/*.ts"
-            ],
-            "ignoreDependencies": [
-                "@fontsource-variable/inter",
-                "@fontsource/jetbrains-mono",
-                "astro",
-                "sharp",
-                "wrangler"
-            ],
-            "astro": true
-        }
+  "$schema": "https://unpkg.com/knip@2/schema.json",
+  "workspaces": {
+    ".": {
+      "entry": [
+        "src/index.ts!",
+        "src/import-events.ts!",
+        "src/cli/index.ts!",
+        "src/scripts/benchmark-queries.ts!",
+        "knexfile.js!"
+      ],
+      "project": [
+        "src/**/*.ts!"
+      ],
+      "ignoreDependencies": [
+        "lzma-native"
+      ],
+      "ignore": [
+        ".nostr/**",
+        "src/utils/relay-probe/**"
+      ],
+      "commitlint": false,
+      "eslint": false,
+      "github-actions": false,
+      "husky": false,
+      "mocha": false,
+      "nyc": false,
+      "semantic-release": false
+    },
+    "website/site": {
+      "entry": [
+        "astro.config.mjs",
+        "src/**/*.{astro,ts,mjs}",
+        "scripts/*.mjs",
+        "worker/**/*.ts"
+      ],
+      "ignoreDependencies": [
+        "@fontsource-variable/inter",
+        "@fontsource/jetbrains-mono",
+        "astro",
+        "sharp",
+        "wrangler",
+        "@astrojs/markdown-remark"
+      ],
+      "astro": true
     }
+  }
 }

.changeset/peering-peer-auth.md

@@ -1,5 +1,43 @@
 # nostream
 
+## 3.11.0
+
+### Minor Changes
+
+- [#1030](https://github.com/cameri/nostream/pull/1030) [`9b585db`](https://github.com/cameri/nostream/commit/9b585db93796b4149d3932487686a46a597b7643) Thanks [@Ferryx349](https://github.com/Ferryx349)! - feat(peering): authenticate peer relays with NIP-42 using the relay keypair
+
+  Adds the peering identity layer: a configured `peering.peers` trust list keyed
+  by relay pubkey (hex or `npub`), outbound NIP-42 AUTH signed with the relay's own
+  keypair, and inbound recognition of a verified peer pubkey on the connection
+  state. Peer status is tied to the NIP-42 session, so it expires or clears with
+  the socket; a valid AUTH from an unconfigured pubkey stays an ordinary client.
+
+  `peering.peers[].relayUrl` is the outbound address only — identity is always the
+  verified pubkey, never the URL. Relay key storage and the AUTH exchange are
+  documented in `docs/PEERING.md`, and the new fields are validated with the rest
+  of the settings document.
+
+### Patch Changes
+
+- [#1024](https://github.com/cameri/nostream/pull/1024) [`eb304b8`](https://github.com/cameri/nostream/commit/eb304b80c9cb997634509df8ef8155fe8ef619dd) Thanks [@chappie-daemon](https://github.com/chappie-daemon)! - fix(deps): bump knex to 3.2.9 for the search_path SQL injection (AIKIDO-2026-10469)
+
+  knex 0.0.1–3.2.8 interpolates values passed to `searchPath` for the Postgres
+  dialect into generated SQL without validating or escaping them, so a value an
+  attacker can influence becomes an injected identifier. 3.2.9 escapes the double
+  quotes ([#6411](https://github.com/cameri/nostream/issues/6411)); this repository declares `knex` 2.4.2 on both the default branch
+  and `rewrite/main`.
+
+  nostream never sets `searchPath` — `grep -rn "search_path" src/` finds nothing —
+  so the reachable path is not exercised today, and the bump is taken to remove a
+  vulnerable dependency from the image, not to close a reachable hole.
+
+  knex 3.0.0 drops Node < 16, which the repo already requires (>=24.14.1), and 3.2.0
+  tightens `RawBinding`. The one compile error that surfaced,
+  `src/scripts/benchmark-queries.ts` passing `bindings as readonly unknown[]` to
+  `db.raw()`, is fixed by dropping the assertion: `toSQL().bindings` is already the
+  accepted type. The emitted JavaScript is byte-identical with and without the
+  assertion.
+
 ## 3.10.2
 
 ### Patch Changes

.knip.json

@@ -1,6 +1,6 @@
 {
   "name": "nostream",
-  "version": "3.10.2",
+  "version": "3.11.0",
   "packageManager": "pnpm@10.33.0",
   "private": true,
   "description": "A Nostr relay written in Typescript.",