[PR] chore: consolidate dependency management [bifromq-sites]

["visoar (via GitHub)" <gi...@apache.org>]

visoar opened a new pull request, #62:
URL: https://github.com/apache/bifromq-sites/pull/62

   ## What changed
   
   - align every direct `@docusaurus/*` package on 3.10.2
   - replace vulnerable transitive dependencies with explicit same-major patched versions
   - standardize the repository on pnpm 10.34.5 and remove the redundant npm lockfile
   - update contributor commands to use pnpm
   - upgrade the GitHub Actions toolchain and run frozen install, typecheck, and build on pull requests
   
   ## Why
   
   The repository deployed with pnpm while Dependabot updated `package-lock.json`, so security PRs did not affect the deployed dependency graph. Mixed Docusaurus versions also caused static site generation failures. A single lockfile and PR build checks make dependency updates deterministic and verifiable.
   
   ## Validation
   
   - `pnpm install --frozen-lockfile` with Node 20 and pnpm 10.34.5
   - `pnpm audit` — no known vulnerabilities
   - `pnpm run typecheck`
   - `pnpm run build`
   
   Supersedes #54, #56, #57, #58, and #59.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@bifromq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] chore: consolidate dependency management [bifromq-sites]

["visoar (via GitHub)" <gi...@apache.org>]

visoar merged PR #62:
URL: https://github.com/apache/bifromq-sites/pull/62


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@bifromq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org