[arzafran]

What this does

Fixes a bug in the published 1.0.3 where scroll triggers ignore Lenis: the build shipped its own copy of lenis/react, so hamo never saw the app's <ReactLenis> and fell back to native scroll. Declaring lenis as a peer dependency keeps it external. Also clears the October 2026 security advisories in the playground and gets the playground building again. Bumps to 1.0.4.

Summary

1. package.json: add lenis: ^1.1.0 to peerDependencies. tsdown keeps peers external, so dist/use-scroll-trigger-*.mjs and dist/scroll-trigger/debugger.mjs now import { useLenis } from "lenis/react" instead of bundling a second LenisContext. It is a required peer because the main hamo entry exports useScrollTrigger.
2. playground/package.json: Astro 4 to 7 (@astrojs/react 7, @astrojs/check 0.9.12). Astro 4 pins Vite 5, Zod 3 and Sharp 0.33, which have no patched releases for the October advisories (vite/launch-editor GHSA-587h, -698v, -r825, -rq7h, -9jrq; sharp GHSA-wq5f; zod GHSA-mrhx; astro GHSA-98hj). Dev-only; the published package was never affected.
3. Playground build fixes: lenis as a dev dependency of packages/react (where it is imported), nullable refs and typed position props in scroll-trigger-app.tsx, and removal of core.astro, which pointed at files that never existed.

Test Plan

• bun install && bun audit: expect no vulnerabilities
• bun run build, then grep -n 'lenis' dist/*.mjs: expect only from "lenis/react" imports and no createContext in the store chunk
• cd playground && bun run build: expect 0 astro check errors and 3 pages built
• In an app using <ReactLenis root>, useScrollTrigger progress follows Lenis scroll (not yet checked in a browser)

Screenshots: before/after needed only as a sanity check. The playground edits are type-only, and the removed /core page could never build.