fix: patch vulnerable dependencies and restore master CI

[JVLegend]

Fixes vulnerable dependency copies, restores CI for master/main PRs, and adds an authorized local braces backport with independent security verification. Current master d5709ed's CV/content is preserved; SEO only has a behavior-equivalent formatting correction. Deployment configuration is unchanged.

Dependency changes:

• Astro 7.2.8, Sharp 0.35.5 direct/override, js-yaml 4.3.2, devalue 5.9.4, SVGO 4.1.0, fast-uri 3.1.8 and compatible transitive security patches.
• Scoped, regression-tested postcss-selector-parser 7.1.6 for Tailwind/PostCSS Nested/Typography, plus the v7 lint consumer. TypeScript ESLint 8.71.1 removes its old fast-glob chain.
• Every braces edge uses the same private, repository-local artifact via a direct devDependency and override "$braces". No registry publication, service or credentials.

Canonical braces backport:

• Commit 32b40ae; source, exact upstream diff, original MIT license, provenance, test snapshots and manifest are in vendor/braces-backport/.
• Artifact: vendor/braces-backport/braces-3.0.3-depth-guard.1.tgz.
• SHA256: 919a91c9ccbdedff3d1d974a1a735a09e690f24fbe4e01207cc3e751ab7b33bf.
• Upstream release commit 74b2db2938fad48a2ea54a9c8bf27a37a62c350d, official npm SHA512 integrity verified. Original name/version remain braces 3.0.3; jvSecurityPatch marks depth-guard.1. This is not an upstream-endorsed release.
• Parser bounds both brace and parenthesis nesting at 100 containers. Iterative preflight protects compile/expand/stringify, including their internal modules and caller-supplied ASTs: depth 100, total visits 20,010, child cycles and cyclic/deep parent chains. maxDepth may tighten the bound (1–100), never raise/disable it.
• Controlled ERR_BRACES_* validation errors replace native stack exhaustion. Ordinary CommonJS/API/options are preserved. Keep handling validation exceptions; uncaught exceptions can still terminate a caller.
• Reusable integration/maintenance instructions are in vendor/braces-backport/README.md. Blinktracking should copy the identical canonical directory and four runners, not create a divergent fork.

Validation of final head 32b40ae:

• Clean npm ci passed locally and in Linux CI. Every installed braces copy and direct consumer resolves to the canonical artifact; installed bytes are checked against the source manifest.
• Independent before/after regression uses a 256 KB stack, 64 MB heap, 15-second timeout and 64 KB output cap. Original compile/expand overflow on an 8,001-character pattern; patched string and direct-AST entry points reject it with ERR_BRACES_DEPTH. Boundary, escaped/quoted/bracketed/mixed patterns, parent/child cycles, invalid maxDepth and node budget are tested.
• 1,400 ordinary pattern/API/option comparisons against the original package passed. All 764 unchanged upstream tests passed (49 suites, zero failures/skips), run through a narrow Node-native adapter without installing obsolete upstream test dependencies.
• Actual micromatch.parse/braces/braceExpand, fast-glob and isolated Chokidar watcher integrations passed. Existing parser CSS regression also passed.
• Build passed: 25 pages plus 404. Astro check: 143 files, zero errors/warnings, 59 hints including imported upstream JavaScript. ESLint and Prettier passed; only exact third-party source/test snapshots are excluded from style rewriting.
• CSS is byte-identical to the preceding head. Source/content/Astro/Tailwind configuration is unchanged. 26 HTML pages, 55 asset references, no missing local assets; removed routes remain absent; no SSR/server output.
• Exact-head Linux artifacts verified by SHA256; remote CSS matches tested local output. Isolated Chrome QA passed menu-to-CV navigation, research accordion, PT/EN CV content, statistics, all eight image decodes and zero runtime exceptions. Vercel preview succeeded.
• Actions run: https://github.com/JVLegend/JVLegend.github.io/actions/runs/37611264974 — completed failure ONLY at the full registry audit. Build, checks, CSS compatibility and braces backport gates passed.

Audit status and limitations:
The original full audit had 29 entries (1 critical, 24 high, 4 moderate); final audit still reports 8 high entries, zero moderate/critical. All eight derive from GHSA-vfj7-8cjw-p6xm for braces <=3.0.3: GHSA-vfj7-8cjw-p6xm . No patched upstream release exists. Name/version were deliberately retained, so npm/Dependabot metadata cannot recognize this local patch. The security evidence is the reviewed diff and independent source/consumer tests; the audit has not been suppressed or described as clean.

Covered chains: Tailwind -> chokidar/braces and micromatch/braces or fast-glob/micromatch/braces; astro-compress directly and via @playform/pipe -> fast-glob/micromatch/braces; astro-eslint-parser -> fast-glob/micromatch/braces. Current patterns are checked-in build/lint configuration, with no public SSR pattern endpoint.

This patch addresses uncontrolled recursion, not every potential denial of service. Aggregate Cartesian expansion, arbitrary input-array length, huge caller-AST literal values and hostile JS accessors/proxies remain outside scope; use quotas/isolation for those cases. Patterns or ASTs over the new bounds intentionally return validation errors. The repository owner must maintain the backport, run the canonical tests in both projects and replace it with a verified compatible upstream fix when available.

Keep draft. Registry alerts/full-audit CI remain visible pending upstream recognition or a later explicit review decision; no audit threshold changes, omissions, ignore rules or forced global major upgrades. No production merge or Pages publication was performed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
jvportfolio	Ready	Preview	Oct 7, 2026 11:01am UTC