[xiaolai]

Summary

npm advisories published on 2026-10-21 turned the required frontend check red (the Security audit step in fe-static) on every open PR, including #1592. This PR patches what can be patched. The two advisories with no usable fix yet are added to the reviewed baseline, each with the reason it is unreachable in the shipped app.

Policy Gates (Required)

• This PR is single-focus (one issue, one problem, one objective).
• This PR includes 100% test coverage for changed behavior and changed code paths. (Dependency and baseline change only; the gate and its tests are unchanged.)
• If this is a bug fix, the linked issue contains detailed reproduction context. (No issue; the failing CI log is the reproduction.)

Linked Issue

• None. This unblocks fix: match Find queries across a soft line break (fixes #1590) #1592.

Type of Change

• Bug fix
• Feature
• Docs
• Refactor
• Test-only
• Other (dependency security)

What Changed

• package.json overrides:
  • vite@7 → >=7.3.7 <8 and vite@8 → >=8.3.4 <9, for the launch-editor advisories GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv and GHSA-r825-w8mm-5pxw.
  • @modelcontextprotocol/server → >=2.3.1 <3, for GHSA-jm63-cq47-j5jp, GHSA-46jr-4wx8-v453 and GHSA-rvq5-wwqv-78pq.
• scripts/npm-audit-baseline.json:
  • The three launch-editor ids remain only for the vite@5 that website>vitepress 1.x requires. No patched 5.x release exists, and it is reached only by the website dev server.
  • markdown-it GHSA-gfr2-rv44-r23c: the fix, 14.3.3, is still inside the minimumReleaseAge window, which ends 2026-10-23. markdown-it is not imported by the app or server/mcp. Once the window passes, raise the override and delete this entry. The two-way gate fails when the advisory clears, so the entry cannot be forgotten.

Validation

• I ran pnpm check:all locally (exit 0).
• node scripts/check-npm-audit.mjs → "every advisory is reviewed and still current".
• check-npm-audit, check-supply-chain-pins and check-scripts-parity tests pass (80/80).
• I manually verified critical flows.

PR Checklist

• The PR avoids unrelated refactors or cleanup.
• The issue context is clear (linked issue or explanation above).
• Docs/changelog were updated if behavior or usage changed. (Not applicable.)
• I am ready to address review feedback.