fix: update vulnerable npm dependencies

Michael Friedrichrequested to merge
security-npm-dependencies into main

Why is this change being made?

The public handbook's locked npm dependency tree reported eight known vulnerabilities: five high and three moderate. The affected packages included js-yaml, linkify-it, markdown-it, nanoid, picomatch, postcss, and yaml.

This MR updates the direct dependencies that select fixed versions:

  • markdownlint-cli2 from 0.18.1 to 0.23.2.
  • postcss from 8.5.6 to 8.5.26.

The Markdownlint version is aligned across package.json, .tool-versions, and the CI container pin. The lockfile refresh uses non-breaking npm audit fix resolution without --force or dependency overrides.

Markdownlint 0.23.2 includes new default behavior that otherwise reports more than 21,000 findings against existing handbook tables. The configuration keeps the previous effective behavior by disabling the new MD060 table-style rule, not treating Hugo front-matter titles as H1 headings, and retaining heading-length enforcement with a 120-character migration ceiling. The upgraded linter scans the full current content tree without requiring unrelated content rewrites.

General dependency currency remains separate and is tracked in docsy-gitlab#40.

Validation

Using Node.js 22.22.0 and Hugo Extended 0.151.0 from .tool-versions:

npm ci
npm audit
npx --no-install markdownlint-cli2 'content/**/*.md'
./scripts/sync-data.sh
hugo --enableGitInfo
git diff --check
added 149 packages, and audited 150 packages
found 0 vulnerabilities

markdownlint-cli2 v0.23.2 (markdownlint v0.41.1)
Linting: 4544 files
Summary: 0 issues in 0 files

The synchronized Hugo build completed and produced public/index.html. Existing CODEOWNERS and sidebar warnings remain unrelated to this dependency update.

Author and Reviewer Checklist

  • Provided a concise title for this merge request.
  • Explained the dependency and lint-configuration changes.
  • Regenerated and reviewed package-lock.json.
  • Validated the complete Markdown tree and synchronized Hugo build.
  • Assign reviewers when the MR is ready for review.

Merge request reports