build(mise), chore(deps): tools and docs-site packages up to date

[laithalsaadoon]

build(mise), chore(deps): tools and docs-site packages up to date (harbor and uv.lock untouched)

Three commits on factory/4-tools-site-deps. Files: mise.toml, mise.lock, site/package.json, site/pnpm-lock.yaml. No uv.lock, no .github/workflows/, no site sources.

Moved

What	From	To
betterleaks	1.8.1	1.9.0
grype	0.119.0	0.120.1
semgrep	1.178.0	1.179.0
syft	1.52.0	1.54.1
trivy	0.74.0	0.75.0
uv	0.12.19	0.12.23
python (3.13)	3.13.15	3.13.16
pnpm (mise.toml and packageManager)	11.27.1	12.10.1
@astrojs/starlight	0.42.4	0.42.5
vitest	5.0.2	5.0.3

node 24 is already at its newest (24.21.0). The other mise tools (osv-scanner, zizmor, actionlint, shellcheck, pip-audit, pyright) did not move.

Held

• typescript 7.0.2: dropped. mise run docs:gate fails at astro check: [ERROR] [check] astro check does not currently support TypeScript 7.0. To continue using astro check, install TypeScript 6 instead. Astro points at @astrojs/ts-content-mapper with TypeScript 7.1+ as the experimental path. typescript stays ~6.0.3, the newest 6.x.
• astro 7.3.5 -> 7.3.7, @astrojs/markdown-remark 7.3.1 -> 7.3.2, @astrojs/markdown-satteri 0.4.2 -> 0.4.3, @tabler/icons-astro 3.48.0 -> 3.49.0: released 2026-10-05 to 2026-10-07, inside the factory's 7-day cooldown. Next bump after 2026-10-14.
• Python 3.14: the owner's call, not taken.
• GitHub Actions: Dependabot ci(deps): bump the actions-minor-patch group with 3 updates #31 and ci(deps): bump jdx/mise-action from 4.3.0 to 5.0.0 #32.

pnpm 12 lockfile

pnpm 12 prepends a second YAML document to site/pnpm-lock.yaml that pins the package manager itself (pnpm@12.10.1 and its @pnpm/exe.* platform binaries). No resolved site dependency changed in that commit. pnpm install --frozen-lockfile and mise run docs:gate accept it. The syft CycloneDX SBOM counts 14 @pnpm/exe components from it, and grype reports none against them. pnpm 11.28.5 is the fallback if you want the lockfile unchanged.

The third commit also changes the optional @types/node peer resolution from 26.6.3 to 24.19.0 (matches node 24); it is a pnpm 12 resolution effect, not a requested bump.

Gates

• mise run check: green, 2351 passed, 1 skipped in 257.73s.
• mise run docs:install && mise run docs:gate (final tree): green, astro check 0 errors, vitest 4 passed files, 64 passed tests, build 21 pages. Also green after each of pnpm 12 and starlight/vitest.
• mise run lint:workflows: green (actionlint).
• mise run security:vex:check: green; the ledger names no scanner version.
• mise run security:sbom (syft 1.54.1, grype 0.120.1): grype SARIF usable with 8 results (braces, source-map-js, http-cache-semantics, postcss-selector-parser, multidict, pyjwt x2, sharp). Not compared with main; none touch what this branch moved. The task's final python3 scripts/verify_sarif.py step needs python >= 3.12 and my shell's python3 was older, so I ran the verifier by hand through mise exec.

Reviewer

Check mise.lock against the table, and rerun mise run docs:install && mise run docs:gate in a fresh worktree since pnpm moved a major.

Lead review

The factory lead re-ran mise run docs:install && mise run docs:gate in a fresh worktree of 28efac6 on 2026-10-08: pnpm 12.10.1, astro check 0 errors, vitest 64 passed. The diff touches only the four files above, and mise.lock carries the versions in the table.

Send-back: the Trivy check on 28efac6 (two commits added on top)

GitHub Advanced Security's Trivy check reported four high alerts, all in site/pnpm-lock.yaml. None came from this branch: the same versions are on origin/main. The check is red because the branch touches the lockfile. Two commits follow; the earlier three are untouched.

6926724 chore(deps): site sharp 0.35.5 and source-map-js 1.2.2

• pnpm update sharp source-map-js --depth 99 (pnpm 12 rejects Infinity). The parents (astro, css-tree) already admit the fixed versions, so no pnpm.overrides entry was needed and site/package.json did not move.
• sharp 0.35.4 to 0.35.5 (GHSA-wq5f-xc86-pv6w, librsvg CVE-2026-96889) with its @img/sharp-* binaries and libvips 1.3.3 to 1.3.4; source-map-js 1.2.1 to 1.2.2 (CVE-2026-93749). Only site/pnpm-lock.yaml changed.
• mise run docs:install && mise run docs:gate: astro check 0 errors, 0 warnings, 0 hints; vitest 64 passed (4 files).

b69ccd3 chore(security): VEX statements for braces 3.0.3 and http-cache-semantics 4.2.0

Neither advisory lists a patched release (first_patched_version null in the GitHub advisory API), so the ledger records why they do not apply. security/atif-sql.openvex.json (document version 2) gains two not_affected statements; osv-scanner.toml is regenerated with mise run security:vex.

• braces 3.0.3 (CVE-2026-93687, stack exhaustion on deeply nested brace patterns), justification vulnerable_code_cannot_be_controlled_by_adversary. Path from pnpm why: starlight-llms-txt 0.12.0 to micromatch 4.0.8 to braces. The brace input is the pattern, and the only caller is micromatch.isMatch(doc.id, pattern) with the literal promote: ["agents", "index*"] from site/astro.config.ts. Build time only.
• http-cache-semantics 4.2.0 (CVE-2026-93748, cross-user disclosure through a shared cache and max-stale), justification vulnerable_code_not_in_execute_path. Path: astro 7.3.5 directly. Used only by astro/dist/assets/build/remote.js for remote images; the site sets no image domains or patterns and uses no remote image. No shared cache, no SSR adapter.
• Neither package is reachable at runtime or on untrusted input, so both statements were written. Each lists its revisit condition.

Gates

• mise run check on head b69ccd3: exit 0, 2351 passed, 1 skipped in 248 s (includes security:vex:check).
• Trivy run locally with the exact flags of mise run security:trivy (--vex security/atif-sql.openvex.json, trivy 0.75.0, HIGH,CRITICAL), counting SARIF results: 28efac6 had 4 (braces, http-cache-semantics, sharp, source-map-js); after 6926724 2 (braces, http-cache-semantics, so the VEX is what clears them); after b69ccd3 0.

For the reviewer

• Only site/pnpm-lock.yaml, security/atif-sql.openvex.json and osv-scanner.toml moved in these two commits.
• The npm PURLs are not asserted against a lockfile by scripts/vex_to_osv_config.py (it checks pypi only), and osv-scanner.toml ignores by advisory id for any version. Trivy and grype scope by PURL version, so a bump of braces or http-cache-semantics reopens the finding there. Read the two impact_statement texts.

Lead review of the send-back

The factory lead checked b69ccd3 in a fresh worktree on 2026-10-08: mise run security:vex:check passes (the toml matches the ledger, 67 lines); trivy with the task's flags and --vex writes a SARIF with 0 results; the same scan without --vex finds exactly braces 3.0.3 and http-cache-semantics 4.2.0 HIGH in site/pnpm-lock.yaml, so the two statements are what clear them and the scan still fails on an unsuppressed finding.

http-cache-semantics 4.3.0 is on npm (the registry lists it after 4.2.0) while GHSA-ch52-4w7c-c8xp still reads <= 4.2.0 with no first patched version. 4.3.0 leaves the advisory's range without changing the max-stale code, so the reachability statement stands; once 4.3.0 clears the repo's 7-day cooldown the factory proposes taking it and retiring statement [1].

🤖 Generated with Claude Code