[rochecompaan]

Summary

The "Site audit and build" CI job fails on every PR. npm audit reports 8 advisories (3 high) in site dependencies: astro, vite, undici, zod, smol-toml, postcss-selector-parser, and @expressive-code/core. They were published after main's last CI run on 14 October.

npm audit fix moves all of them to patched versions within the current ranges, including Astro 7.3.2 → 7.4.2. No change to site/package.json was needed. But Astro 7.4 requires http-cache-semantics ^4.3.0, so npm stopped using our patched local copy:

 site
 ├─┬ astro@7.4.2
-│ └── http-cache-semantics@4.2.0 -> vendor/http-cache-semantics   (patched)
+│ └── http-cache-semantics@4.3.0 (registry, no max-stale fix)

Upstream PR #58 closed without a merge, and 4.3.0 doesn't fix max-stale. npm audit can't flag 4.3.0, because the advisory lists only <= 4.2.0 as affected. This PR updates the local copy to 4.3.0 and reapplies the same patch, so Astro uses the patched code again:

vendor/http-cache-semantics/
├── index.js       # upstream 4.3.0 (b1d4bd6) + PR #58 patch, same hunks as before
├── package.json   # version 4.3.0, still private
└── README.md      # source commit, upstream status

Evidence

• Before: npm --prefix site audit --audit-level=high → 8 vulnerabilities (1 low, 4 moderate, 3 high), exit 1.
  After: found 0 vulnerabilities.
• With registry 4.3.0 after npm audit fix: npm --prefix site test → 7 of 13 cache security tests fail. Examples: "max-stale cannot bypass another user's session cookie" and "stale-while-revalidate cannot bypass shared session-cookie restrictions".
  With patched local 4.3.0: 13 of 13 pass.
• npm --prefix site run build passes and builds the same 18 pages as main. It shows the same two content warnings (i18n collection, 404 entry) that main already shows.
• The npm 4.3.0 index.js matches upstream commit b1d4bd6 byte for byte. The patch diff against it matches the old patch diff against 4.2.0 line for line.
• Root npm run lint and bin/package-files.test.ts pass.

Merge Danger

Door: two-way. Reverting brings back the old lockfile and patched 4.2.0.

Blast Radius: site-only. The lockfile changes 155 package versions, mostly from the Astro 7.4 and Vite 8.3 updates. The CLI package and its npm dependencies are unchanged.