Fix reported vulnerabilities

.devcontainer/Dockerfile

@@ -1,4 +1,7 @@
-ARG DEVCONTAINER_BASE=mcr.microsoft.com/devcontainers/base:1.0.9-ubuntu-22.04
+ARG DEVCONTAINER_BASE=yardl-base
+
+# Expose the default image to Dependabot while retaining build-arg overrides.
+FROM mcr.microsoft.com/devcontainers/base:1.0.9-ubuntu-22.04 AS yardl-base
 
 #########################################################
 # devcontainer stage

.github/dependabot.yml

@@ -15,7 +15,9 @@ updates:
         patterns:
           - "*"
   - package-ecosystem: github-actions
-    directory: /
+    directories:
+      - /
+      - /.github/actions/configure-environment
     schedule:
       interval: weekly
     cooldown:
@@ -28,3 +30,23 @@ updates:
         applies-to: security-updates
         patterns:
           - "*"
+  - package-ecosystem: npm
+    directory: /docs
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      npm:
+        patterns:
+          - "*"
+      npm-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+  - package-ecosystem: docker
+    directory: /.devcontainer
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7

.github/workflows/ci.yml

@@ -151,13 +151,38 @@ jobs:
             exit 1
           fi
 
+  buildDocs:
+    name: Build documentation
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: docs/package-lock.json
+      - name: Install documentation dependencies
+        working-directory: docs
+        run: npm ci
+      - name: Build static page
+        working-directory: docs
+        run: npm run docs:build
+      - name: Upload Pages artifact
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'microsoft/yardl'
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: 'docs/.vitepress/dist'
+
   publishDocs:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'microsoft/yardl'
     needs:
       - validate
       - smoketestWindows
       # - smoketestMac # Disabling until this is fixed: https://github.com/Homebrew/homebrew-core/issues/159691
       - noticeCheck
+      - buildDocs
 
     runs-on: ubuntu-latest
 
@@ -178,20 +203,8 @@ jobs:
       cancel-in-progress: false
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Build static page
-        run: |
-            cd docs
-            npm install
-            npm run docs:build
       - name: Setup Pages
         uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
-        with:
-          # Upload entire repository
-          path: 'docs/.vitepress/dist'
       - name: Deploy to GitHub Pages
         id: deployment
         uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

docs/.npmrc

@@ -0,0 +1 @@
+omit-lockfile-registry-resolved=true

docs/.vitepress/config.mts

@@ -135,17 +135,18 @@ export default defineConfig({
                 // search result is for. So we augment the "titles" field with
                 // either C++ or Python if the document is under one of those paths.
 
+                // VitePress 2 search IDs exclude the configured site base.
                 var documentId: string = document["id"];
-                if (documentId.startsWith("/yardl/cpp")) {
+                if (documentId.startsWith("/cpp/")) {
                   // Include "C++"" in the search preview "path"
                   return ["C++"].concat(fieldValue);
                 }
 
-                if (documentId.startsWith("/yardl/python")) {
+                if (documentId.startsWith("/python/")) {
                   return ["Python"].concat(fieldValue);
                 }
 
-                if (documentId.startsWith("/yardl/matlab")) {
+                if (documentId.startsWith("/matlab/")) {
                   return ["Matlab"].concat(fieldValue);
                 }
               }

docs/README.md

@@ -7,3 +7,20 @@ $ just start-docs-website
 ```
 
 In most cases, the page in the browser should update when saving the markdown files. But changes to `.vitepress/config.mts` require a page reload.
+
+Use Node.js 24, as in CI. To install the locked dependencies and check the site:
+
+```bash
+cd docs
+npm ci
+npm audit
+npm run docs:build
+```
+
+Dependency upgrades must update both `package.json` and `package-lock.json`.
+The lockfile omits registry-specific tarball URLs so installs can use the
+configured npm registry or proxy while still verifying package integrity hashes.
+CI builds the documentation on pull requests before publishing it from `main`.
+The site currently uses VitePress 2 alpha because VitePress 1 depends on the
+unsupported Vite 5 release line. Keep the prerelease pinned and validate future
+upgrades with a full build and a check of navigation and local search.