meta: harden dependency supply chain (#1178)

Author: ovflowd

.changeset/trim-runtime-dependencies.md

@@ -0,0 +1,6 @@
+---
+'@doc-kit/core': patch
+'@doc-kit/generator-react': patch
+---
+
+Install fewer packages: `@doc-kit/core` updates `cosmiconfig` to v10 (TypeScript config files now load through Node's type stripping) and no longer installs `dedent`, and `@doc-kit/generator-react` estimates reading time with `Intl.Segmenter` instead of the `reading-time` package and updates `@node-core/ui-components` to 1.8.1, which no longer installs `@vcarl/remark-headings`.

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Setup environment
-        uses: nodejs/web-team/actions/setup-environment@9f3c83af227d721768d9dbb63009a47ed4f4282f
+        uses: nodejs/web-team/actions/setup-environment@4c0b18db11a8357664683d70ef1f27af08ecc766
         with:
           use-version-file: true
           pnpm: true
@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Setup environment
-        uses: nodejs/web-team/actions/setup-environment@9f3c83af227d721768d9dbb63009a47ed4f4282f
+        uses: nodejs/web-team/actions/setup-environment@4c0b18db11a8357664683d70ef1f27af08ecc766
         with:
           use-version-file: true
           pnpm: true
@@ -63,7 +63,7 @@ jobs:
 
     steps:
       - name: Setup environment
-        uses: nodejs/web-team/actions/setup-environment@9f3c83af227d721768d9dbb63009a47ed4f4282f
+        uses: nodejs/web-team/actions/setup-environment@4c0b18db11a8357664683d70ef1f27af08ecc766
         with:
           use-version-file: true
           pnpm: true

.github/workflows/dependency-review.yml

@@ -27,7 +27,8 @@ jobs:
           allowed-endpoints: >
             github.com:443
             api.github.com:443
-            api.deps.dev
+            api.deps.dev:443
+            api.securityscorecards.dev:443
 
       - name: Git Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/generate.yml

@@ -115,7 +115,7 @@ jobs:
             compare: file-size
     steps:
       - name: Setup environment
-        uses: nodejs/web-team/actions/setup-environment@9f3c83af227d721768d9dbb63009a47ed4f4282f
+        uses: nodejs/web-team/actions/setup-environment@4c0b18db11a8357664683d70ef1f27af08ecc766
         with:
           use-version-file: true
           pnpm: true

.github/workflows/publish.yml

@@ -35,12 +35,13 @@ jobs:
       id-token: write
     steps:
       - name: Setup environment
-        uses: nodejs/web-team/actions/setup-environment@9f3c83af227d721768d9dbb63009a47ed4f4282f
+        uses: nodejs/web-team/actions/setup-environment@4c0b18db11a8357664683d70ef1f27af08ecc766
         with:
           use-version-file: true
           pnpm: true
           registry-url: 'https://registry.npmjs.org'
           fetch-depth: 0
+          cache: false
 
       - name: Create Release Pull Request or Publish
         id: changesets

docs/configuration.md

@@ -12,7 +12,7 @@ Use `--config-file <path>` to load a specific file instead of searching.
 Configuration files can be either:
 
 - **JavaScript** (`.js`, `.mjs`, `.cjs`)
-- **TypeScript** (`.ts`, when `typescript` is installed in the project)
+- **TypeScript** (`.ts`, loaded through Node.js type stripping, so only erasable syntax such as type annotations works)
 - **JSON** (`.json`)
 - **YAML** (`.yaml`, `.yml`, or an extensionless rc file)
 

package.json

@@ -50,6 +50,6 @@
     "lint-staged": "17.6.0",
     "oxfmt": "0.71.0",
     "oxlint": "1.86.0",
-    "wrangler": "4.148.0"
+    "wrangler": "4.151.1"
   }
 }

packages/core/package.json

@@ -56,8 +56,7 @@
     "@swc/html-wasm": "^1.16.2",
     "@swc/wasm": "^1.15.46",
     "acorn": "^8.17.0",
-    "cosmiconfig": "^9.0.2",
-    "dedent": "^1.7.2",
+    "cosmiconfig": "^10.0.1",
     "github-slugger": "^2.0.0",
     "glob-parent": "^6.0.2",
     "mdast-util-slice-markdown": "^2.0.1",
@@ -83,6 +82,7 @@
   },
   "devDependencies": {
     "ajv": "^8.20.0",
+    "dedent": "^1.7.2",
     "hast-util-to-html": "^9.0.5",
     "hast-util-to-string": "^3.0.1"
   },

packages/core/src/threading/index.mjs

@@ -28,6 +28,7 @@ export default function createWorkerPool(threads) {
     // of work on the main thread, such as bundling the site
     idleTimeout: 250,
     resourceLimits: { maxOldGenerationSizeMb: WORKER_HEAP_SIZE },
+    recordTiming: false,
     workerData: { logLevel: logger.getLogLevel() },
   });
 }

packages/react/package.json

@@ -36,7 +36,7 @@
     "@fontsource/ibm-plex-mono": "^5.3.0",
     "@heroicons/react": "^2.2.0",
     "@node-core/rehype-shiki": "^1.5.1",
-    "@node-core/ui-components": "^1.8.0",
+    "@node-core/ui-components": "^1.8.1",
     "@orama/orama": "^3.1.18",
     "@orama/ui": "^1.5.4",
     "estree-util-to-js": "^2.0.0",
@@ -47,7 +47,6 @@
     "mdast-util-slice-markdown": "^2.0.1",
     "preact": "^10.29.7",
     "preact-render-to-string": "^6.7.0",
-    "reading-time": "^1.5.0",
     "recma-jsx": "^1.0.1",
     "recma-stringify": "^1.0.0",
     "rehype-raw": "^7.0.0",