chore(deps): bump BenSheridanEdwards/StyleProof from 4.4.21 to 4.7.0

[dependabot]

Bumps BenSheridanEdwards/StyleProof from 4.4.21 to 4.7.0.

Release notes

Sourced from BenSheridanEdwards/StyleProof's releases.

v4.7.0

Added

• Reports publish through the git-data API. The Action now writes each report to the report branch through GitHub's git-data API — upload the blobs, build a tree on the branch tip, advance the branch with a single fast-forward — instead of a working-tree commit. Publication no longer checks out the report branch, and the publish path is factored into small helpers that are covered on their own.
• styleproof-init prunes reports by API with a retention and size-budget sweep. Report branches grew without bound. A new prune pass removes reports older than a retention window and then trims the branch back under a size budget through the same git-data API, so the report store stays cheap to fetch and hold. The prune feature is self-contained and independently tested.
• CERTIFICATION_FAILED is now dogfooded end-to-end. The action-dogfood workflow exercised six of the eight trust states; CERTIFICATION_FAILED was not one of them — which is precisely why 4.6.2's content-geometry regression (it wrongly routed copy-editing PRs into that state) shipped undetected. A new certfail fixture pair with unproven determinism now drives the Action to CERTIFICATION_FAILED and asserts it hard-fails, so a regression in that branch can never merge silently again.

Security

• Cleared two high-severity transitive advisories. brace-expansion 5.0.6 → 5.0.7 and fast-uri 3.1.3 → 3.1.4 (GHSA-v2hh-gcrm-f6hx, host confusion via a literal backslash authority delimiter). Both were lockfile-only bumps with no code or manifest change; npm audit --audit-level=high is back to zero vulnerabilities.

v4.6.3

Fixed

• Content-driven geometry is reviewable evidence, not an unapprovable state. 4.6.2 mapped any geometry drift whose element's own text length changed to CERTIFICATION_FAILED — the state the approval box cannot clear — so every copy-editing PR became an unclearable red, one such finding poisoned runs that also carried clean reviewable changes, and the report claimed "no reviewable crops" while crops rendered. Content-driven geometry now stays in the display set, counts as reviewable, and gates as VISUAL_APPROVAL_REQUIRED; the legacy 'unknown' signal falls back to ordinary casualty/resurrection semantics so compares against pre-4.6.2 bundles stay usable.
• --spec-ref overlay bundles are restorable. The published base bundle's spec hash is the head spec's bytes, but restore probes hashed the base's own spec — the bundle could never restore (every push silently repaid the full cold rebuild), while a hit on a non-overlay bundle skipped the overlay entirely, comparing base-spec renders against head-spec renders. The base

... (truncated)

Changelog

Sourced from BenSheridanEdwards/StyleProof's changelog.

Changelog

All notable changes to StyleProof are documented here.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[4.7.0] - 2026-07-22

Added

• Reports publish through the git-data API. The Action now writes each report to the report branch through GitHub's git-data API — upload the blobs, build a tree on the branch tip, advance the branch with a single fast-forward — instead of a working-tree commit. Publication no longer checks out the report branch, and the publish path is factored into small helpers that are covered on their own.
• styleproof-init prunes reports by API with a retention and size-budget sweep. Report branches grew without bound. A new prune pass removes reports older than a retention window and then trims the branch back under a size budget through the same git-data API, so the report store stays cheap to fetch and hold. The prune feature is self-contained and independently tested.
• CERTIFICATION_FAILED is now dogfooded end-to-end. The action-dogfood workflow exercised six of the eight trust states; CERTIFICATION_FAILED was not one of them — which is precisely why 4.6.2's content-geometry regression (it wrongly routed copy-editing PRs into that state) shipped undetected. A new certfail fixture pair with unproven determinism now drives the Action to CERTIFICATION_FAILED and asserts it hard-fails, so a regression in that branch can never merge silently again.

Security

• Cleared two high-severity transitive advisories. brace-expansion 5.0.6 → 5.0.7 and fast-uri 3.1.3 → 3.1.4 (GHSA-v2hh-gcrm-f6hx, host confusion via a literal backslash authority delimiter). Both were lockfile-only bumps with no code or manifest change; npm audit --audit-level=high is back to zero vulnerabilities.

[4.6.3] - 2026-07-20

Fixed

• Content-driven geometry is reviewable evidence, not an unapprovable state. 4.6.2 mapped any geometry drift whose element's own text length changed to CERTIFICATION_FAILED — the state the approval box cannot clear — so every copy-editing PR became an unclearable red, one such finding poisoned runs that also carried clean reviewable changes, and the report claimed "no reviewable crops" while crops rendered. Content-driven geometry now stays in

... (truncated)

Commits

• 6bb25e9 chore(release): prepare 4.7.0 (#332)
• 517b109 fix(deps): resolve the fast-uri high-severity audit advisory (#331)
• 4f8ae3b feat(init): prune reports by API with a retention and size-budget sweep (#329)
• 82afbea feat(action): publish reports through the git-data API (#328)
• 35a74dd test(action): dogfood CERTIFICATION_FAILED end-to-end (#327)
• 4b1e654 ci: bump actions/setup-node from 6 to 7 (#312)
• 8593b02 fix(deps): resolve the brace-expansion audit advisory (#330)
• 1644135 Merge pull request #326 from BenSheridanEdwards/release/4.6.3
• 1864e06 chore(release): prepare 4.6.3
• 7245fea fix: repair the six 4.6.x audit findings (#325)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Fallow audit report

Found 1 finding.

Details

Severity	Rule	Location	Description
minor	fallow/unused-dev-dependency	package.json:49	Package '@lhci/cli' is in devDependencies but never imported

Generated by fallow.

[github-actions]

Fallow audit report

0 inline findings selected for GitHub review.

[github-actions]

🗺️ StyleProof report

📊 View the side-by-side visual report →

---

No visual changes detected — the StyleProof check is green.

[dependabot]

Superseded by #43.