[amondnet]

Summary

Clears all 13 open Dependabot alerts on website/package.json (the Astro Starlight docs site), starting with the critical one.

Commit 1 — astro (critical first)

• astro ^5.6.0 → ^7.4.0. Fixes GHSA-26w7-cxv4-gfx2 (critical: remote code execution through AVIF image optimization), which is patched only in 7.2.8 — there is no 5.x/6.x backport, so this has to cross two majors. It also fixes the other nine astro advisories (XSS, host-header SSRF, base-path authorization bypass, server-island replay), all patched at or below 7.2.8.
• Companion bumps required by astro 7: @astrojs/starlight ^0.36.0 → ^0.42.6 (peer astro ^7.2.10) and starlight-theme-black ^0.6.0 → ^0.7.1 (peer @astrojs/starlight >=0.41).
• One migration edit in astro.config.mjs: Starlight 0.39.0 removed autogenerated sidebar groups, so the Services group now wraps it as items: [{ autogenerate: { directory: 'services' } }]. Same label, same directory, same pages.

Commit 2 — sharp

• sharp ^0.34.0 → ^0.35.5. Fixes GHSA-wq5f-xc86-pv6w, GHSA-rgj7-g3m4-5g8c and GHSA-f88m-g3jw-g9cj (libvips / libheif / librsvg).
• Adds "overrides": { "sharp": "^0.35.5" }. Without it, wrangler 4.107.0's miniflare pins sharp 0.34.5 exactly, which leaves a vulnerable copy (and libvips 1.2.x) in website/bun.lock. Newer miniflare only goes to 0.35.2, so bumping wrangler would not fix it. With the override the lockfile holds a single sharp@0.35.5.

Related issue

None — Dependabot alerts: https://github.com/pleaseai/emulate/security/dependabot

Checklist

• PR title follows Conventional Commits
• Tests added or updated, and the suite passes (bun run test) — n/a, website/ only; verified by building the site (below)
• Lint/format pass (bun run lint)
• Documentation updated if behavior changed — no content changes
• No breaking change, or a BREAKING CHANGE: note is included

Test plan

Run in website/ after each commit (each commit builds on its own):

• bun install --frozen-lockfile is clean (the Docs workflow uses it)
• bun scripts/sync-services.ts leaves src/content/docs/services unchanged
• bun run build succeeds: 22 pages, Pagefind index and sitemap generated
• find dist -name '*.html' | sort is identical to the build of main before the change (22 routes)
• bun.lock has a single astro@7.4.0 and a single sharp@0.35.5; no sharp@0.34 or libvips 1.2.x left
• wrangler --version still runs (4.107.0) with the sharp override

Notes

• astro 7.4 requires Node >=22.22.0. mise.toml pins node = "22", which mise resolves to the latest 22.x (22.23.2 locally), so CI meets it.
• The build prints two content warnings (The collection "i18n" does not exist or is empty, Entry docs → 404 was not found); the 404 page still builds. It is not yet confirmed whether these also appear on main.
• The Docs workflow deploys a Cloudflare Pages preview for this PR — worth a visual check of the sidebar and theme there.

---

Summary by cubic

Upgrades the docs site dependencies to clear all 13 open Dependabot alerts in website/package.json.

• astro ^5.6.0 → ^7.4.0 fixes a critical AVIF image-optimization RCE (GHSA-26w7-cxv4-gfx2) that has no 5.x/6.x backport, along with the other nine astro advisories (XSS, SSRF, auth bypass, server-island replay).
• Companion bumps @astrojs/starlight to ^0.42.6 and starlight-theme-black to ^0.7.1 to satisfy astro 7 peer requirements.
• sharp ^0.34.0 → ^0.35.5 fixes libvips, libheif, and librsvg advisories; an overrides entry forces a single sharp 0.35.5 because wrangler's miniflare pins 0.34.5 exactly.

Migration

• Starlight 0.39 removed autogenerated sidebar groups; the Services group in astro.config.mjs now wraps autogenerate in an items array with no change to the rendered sidebar.
• astro 7.4 requires Node >=22.22.0; mise.toml pins node = "22", so CI qualifies.

^{Written for commit edaa11f. Summary will update on new commits.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	starlight-theme-black@​0.6.0 ⏵ 0.7.1	+3		+1	+9
	@​astrojs/​starlight@​0.36.3 ⏵ 0.42.6			+1	-1
	astro@​5.18.2 ⏵ 7.4.0	+1	+75	+1
	sharp@​0.34.5 ⏵ 0.35.5	+5	+31	+1

View full report

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cubic-dev-ai]

No issues found across 3 files

Architecture diagram

sequenceDiagram
    participant Dev as Local Dev / CI
    participant Mise as mise.toml (Node 22.x)
    participant Bun as Bun Lockfile
    participant Wrangler as Wrangler 4.107.0
    participant Astro as Astro 7.4 Build
    participant Starlight as Starlight 0.42.6
    participant Sharp as sharp 0.35.5
    participant Dist as Static Dist Output
    participant Pages as Cloudflare Pages
    participant Crawler as Pagefind/Sitemap

    Note over Dev,Pages: Docs Site Architecture (Current State)

    Dev->>Mise: node = "22" (resolves >= 22.22.0)
    Mise-->>Dev: Node 22.23.2

    Dev->>Bun: bun install --frozen-lockfile
    Bun->>Bun: Single astro@7.4.0 + sharp@0.35.5
    Note over Bun: overrides forces sharp to 0.35.5
    Bun-->>Wrangler: miniflare pins sharp 0.34.5 -> override applied
    Bun-->>Dev: Clean install

    Dev->>Astro: bun run build
    Astro->>Astro: Load astro.config.mjs
    Astro->>Starlight: Integrate (peer astro ^7.2.10)
    Starlight->>Starlight: Sidebar "Services" autogenerate (new items wrapper)
    Astro->>Sharp: Image optimization pipeline
    Sharp->>Sharp: libvips / libheif / librsvg (patched)
    Astro->>Astro: Compile 22 pages (SSG)
    Astro->>Dist: Write static HTML
    Dist->>Crawler: Pagefind index + sitemap

    Note over Astro,Dist: Alt branch: content warnings (i18n empty, 404 missing)
    Note over Dist,Pages: Expected output (22 HTML files)

    Dev->>Pages: wrangler pages deploy dist
    Wrangler-->>Pages: Upload dry artifacts
    Pages-->>Dev: Preview URL (docs workflow)
    Dev->>Pages: Visual check on sidebar/theme
    Pages-->>Dev: Confirmed rendering

    Note over Dist,Pages: Security posture: no vulnerable astro/sharp copies in lockfile

Loading

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable issues were established.

Summary

Updates the docs site to Astro 7.4, Starlight 0.42.6, and starlight-theme-black 0.7.1.

• The docs site upgrades Astro and Sharp to patched dependency versions.

Verification was limited to source and configuration checks. No build or browser check was run; installed website dependencies and build output were unavailable.

Acknowledged by amondnet: the build reports warnings about the empty i18n collection and missing docs → 404 entry. The PR description states that the 404 page still builds and that comparison with the base branch remains unconfirmed.

_{Reviews (1) · Last reviewed commit: "fix(website): upgrade sharp to 0.35.5 fo..." · Reviewed by Greptile}