[amondnet]

Summary

#34 closed the 13 open Dependabot alerts on main (1 critical, 5 high, all astro/sharp in website/package.json). bun audit still reported vulnerabilities in transitive dependencies that Dependabot had not alerted on. This PR clears them in both the root project and website/, and aligns website's packageManager with the bun version that now writes its lockfile.

What changed

• Root: bun audit 13 vulnerabilities (9 high, 3 moderate, 1 low) → 0.
  • In-range updates (bun audit fix): brace-expansion 5.0.6 → 5.0.12, nanoid 3.3.12 → 3.3.18, postcss 8.5.15 → 8.5.23, source-map-js 1.2.1 → 1.2.2.
  • Overrides: decode-uri-component ^0.5.0 (pulled by query-string via autumn-js) and katex ^0.18.2 (only via micromark-extension-math in the ESLint markdown tooling).
• website: bun audit 19 (6 high, 10 moderate, 3 low) → 0.
  • In-range updates: js-yaml 4.3.0 → 4.3.2, source-map-js 1.2.1 → 1.2.2.
  • Overrides: postcss-selector-parser ^7.1.6 (postcss-nested declares ^6.1.1 and no patched 6.x exists), and miniflare: { undici: "^7.29.1" } (miniflare pins undici 7.28.0 exactly; scoped so unifont keeps undici 8.x).
• website/package.json: packageManager bun@1.3.14 → bun@1.4.3. The lockfile is now written by bun 1.4.3, which 1.3.14 cannot read (UnknownLockfileVersion on --frozen-lockfile), and mise resolves bun from this field. This matches the root (build: upgrade bun to 1.4.3 and type-check with bun check #35).

Scope

Dependency and lockfile changes only. No source changes.

Blast radius

Every affected root package is dev tooling, and root overrides do not reach consumers of the published packages. The website changes affect only the docs build.

Related issue

None.

Verification

• Root, bun 1.4.3: bun install --frozen-lockfile, bun run lint, bun run type-check (27/27), bun run test:coverage (290 pass, 0 fail; autumn emulator tests 15/15), bun run build (14/14).
• website, mirroring docs.yml: bun install --frozen-lockfile, bun scripts/sync-services.ts (services/ unchanged), bun run build (22 pages).
• bun audit in both projects: "No vulnerabilities found".

Checklist

• PR title follows Conventional Commits
• Tests added or updated, and the suite passes (bun run test)
• Lint/format pass (bun run lint)
• Documentation updated if behavior changed (no behavior change)
• No breaking change, or a BREAKING CHANGE: note is included

---

Summary by cubic

Resolves transitive bun audit vulnerabilities in the root project and the docs website without changing runtime behavior, bringing both projects to zero findings.

Root: in-range updates to brace-expansion, nanoid, postcss, and source-map-js, plus overrides for decode-uri-component and katex, both pulled only by dev tooling. Website: updates to js-yaml and source-map-js, plus an override for postcss-selector-parser (no patched 6.x exists) and an undici override scoped to miniflare so unifont stays on undici 8.x.

Notes

• website packageManager bumps to bun@1.4.3 so the lockfile, now written by 1.4.3, is readable under --frozen-lockfile.
• Dependency and lockfile changes only; all affected packages are dev tooling, so root overrides do not reach published consumers.

^{Written for commit c632488. Summary will update on new commits.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable issues were found.

Summary

Updates transitive dependencies in the root project and docs website.

• Root installs use updated versions of transitive packages.
• Website installs use updated packages and Bun 1.4.3.

_{Reviews (1) · Last reviewed commit: "style(website): sort override keys for j..." · Reviewed by Greptile}

[cubic-dev-ai]

No issues found across 4 files

Architecture diagram

sequenceDiagram
    participant Dev as Developer
    participant CLI as Bun CLI (1.4.3)
    participant Lock as Lockfile (bun.lock)
    participant Reg as npm Registry
    participant Root as Root package.json
    participant Web as website/package.json
    participant Build as Build Pipeline

    Note over Dev,Build: Dependency resolution and audit flow

    Dev->>CLI: bun install --frozen-lockfile
    CLI->>Root: Read package.json (root)
    CLI->>Web: Read package.json (website)
    Root->>Root: Apply overrides (decode-uri-component, katex)
    Web->>Web: Apply overrides (postcss-selector-parser, miniflare.undici)
    CLI->>Reg: Resolve dependency tree
    Reg-->>CLI: Package metadata + versions
    CLI->>Lock: Verify lockfile version (bun 1.4.3 compatible)
    alt Lockfile version mismatch (bun 1.3.14)
        Lock-->>CLI: UnknownLockfileVersion error
        CLI-->>Dev: Fail with error
    else Lockfile readable (bun 1.4.3)
        Lock->>Lock: Resolve with overrides applied
        Lock-->>CLI: Frozen dependency tree
        CLI-->>Dev: Install complete
    end

    Dev->>CLI: bun audit
    CLI->>Lock: Scan resolved dependencies
    Lock-->>CLI: Vulnerability report
    alt Vulnerabilities found
        CLI-->>Dev: Report findings (0 expected)
    else No vulnerabilities
        CLI-->>Dev: "No vulnerabilities found"
    end

    Note over Dev,Build: Build and verification flows

    Dev->>CLI: bun run build
    CLI->>Build: Execute build script
    Build->>Root: Use root dev tooling (postcss, nanoid, katex)
    Build->>Web: Use website deps (astro, wrangler, miniflare)
    Build->>Build: Process with postcss-selector-parser (patched 7.x)
    Build->>Build: Use undici 7.x (scoped to miniflare)
    alt unifont also requires undici
        Build->>Build: Keep undici 8.x for unifont
    end
    Build-->>Dev: Build complete (14/14 root, 22 pages website)

Loading

_{Turn on auto-fix | Re-trigger cubic}