[VdustR]

Closes #17.

Patch the exact transitive resolutions behind newly authorized Dependabot alerts 247–257. Harmless local probes reproduced the vulnerable dependency contracts before the update and pass afterward; this does not assert remote exploitability of the static documentation site.

• Pin Handlebars 4.7.10, smol-toml 1.9.0, source-map-js 1.2.2, proxy-addr 2.0.8, compression 1.8.2 and selector-parser 7.1.6.
• Limit KaTeX 0.18.2 to micromark and tinypool 2.1.2 to Docusaurus. Verify their actual consumers across the version boundaries; retain existing supply-chain policies.
• Add a read-only PR build workflow with frozen installation, library tests, demo and documentation builds. Keep the existing Pages deployment unchanged.

Validation: frozen install; before/after probes for inherited trust/options, AST validation, precompiled script termination, mapped subnet trust, indexed source-map offsets, aborted compression stream cleanup and TOML key scanning; bounded flat-selector timing; 56 selector AST differential cases; both cssnano preset versions; micromark inline/block math; library tests; demo build; normal and forced two-worker Docusaurus production builds; ESLint, Prettier, cspell, stylelint, root TypeScript and diff checks. Independent adversarial review completed, with its CI-permission finding fixed.

Existing docs typecheck fails with TS5102 (baseUrl removed) both before and after; this is preserved as a separate baseline limitation, not claimed fixed. Existing http-cache-semantics work in #14 and release issue #8 remain outside scope. This lockfile/tooling repair needs the normal Pages deployment after merge; no published library manifest or source changes require an npm release.

[changeset-bot]

⚠️ No Changeset found

Latest commit: a822096

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR