[mbeacom]

What and why

The docs site has its own lockfile, outside the root audit gate. bun audit there reported ten advisories: two high, seven moderate, one low. All of them are in build-time dependencies, and none ships in any @adrkit/* package:

• undici 8.11.2, via Astro's unifont: GHSA-xjj6-f33q-929c (high), plus two moderate.
• vite 8.3.2 and the launch-editor code it bundles: GHSA-587h-7wmj-h5pm (high), plus five moderate and one low.
• postcss-selector-parser 6.1.4, via postcss-nested: GHSA-rj75-hqrm-r3gf (moderate). The only fix is in 7.x.

I dropped the undici and vite lockfile entries and let bun re-resolve under the site's 3-day minimumReleaseAge. That moved more than those two packages, but every change stays inside its declared range and no package.json changes. Notable moves:

• astro 7.3.7 → 7.4.2
• @astrojs/starlight 0.42.5 → 0.42.6
• vite 8.3.5
• undici 8.12.3
• postcss-nested 7, which brings in postcss-selector-parser 7.1.7

Checklist

• Commits are DCO signed off.
• No recorded decision changes.
• No schema change; check:schema passes.
• packages/ci/src and @adrkit/core are untouched.
• No new behavior to test.
• Site checks pass: bun audit reports no vulnerabilities, the site builds 72 pages, and check:rendered holds all 40 rendered invariants in Chrome.

Notes for reviewers

• The build prints the same two content warnings that main prints: an empty i18n collection and no 404 docs entry. This change doesn't introduce them.

• The lockfile diff is wide because of the in-range refresh. If you'd rather review something narrower, the vulnerable packages could be pinned individually instead, but postcss-selector-parser would then need an override to reach 7.x.

• The Deploy site build now sets up Node 24 explicitly. Astro 7.4 requires Node >=22.23.4, and the runner image's default Node is 22.23.3, so the first push failed in astro build. The site builds and check:rendered passes under Node 24 locally.

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[github-actions]

Decisions governing this change

5 accepted decisions govern this change

• 0007 — Isolate integrations as optional adapters and build only against public surfaces
  • via path: .github/workflows/**
• 0010 — Use Bun as the package manager and test runner while publishing Node-targeted artifacts
  • via path: .github/workflows/**
• 0011 — Host the canonical JSON Schema at its $id on adrkit.dev
  • via path: .github/workflows/site.yml
  • via path: site/**
• 0025 — Ship badges as recipes over existing output, not a new CLI surface
  • via path: .github/workflows/site.yml
• 0035 — Execute the gates that certify a pull request from the default branch
  • via path: .github/workflows/**

_{Links point at 00649f1, this run's GITHUB_SHA. Run adr explain <path> locally to see why a file is governed.}

[Copilot]

🔵 Needs a closer look

The broad dependency refresh needs human confirmation of the reported audit, build, and browser-validation results.

No open issues 🎉

_{Review effort: Balanced}