fix: maintenance pass pt2 — 0 audit CVEs, a11y fixes, rate-limiter regression, markdown defense-in-depth

[llbbl]

Summary

• Dependency upgrades close all remaining audit CVEs (astro server-island replay low, smol-toml DoS moderate) — pnpm audit now reports 0 vulnerabilities
• Rate-limiter regression fixed: missing/invalid X-Forwarded-For previously generated a unique key per request, silently disabling the limiter; unattributed requests now share a fallback bucket
• Defense-in-depth scheme allowlist added to markdown link/image renderers before sanitize-html (blocks whitespace-prefix bypass e.g. " javascript:...")
• Accessibility improvements across mobile menu, theme switcher, and search results; TOC active-heading tracking fixed for duplicate headings

Changes

Security / Dependencies

• package.json: astro 6.1.9 → 6.4.4; react 19.2.7, marked, @biomejs/biome 2.4.16, @astrojs/node 10.1.3, tailwindcss 4.3.0, lucide-react 1.17.0, tailwind-merge 3.6.0, @types/* and tsx patch bumps
• pnpm-workspace.yaml: add smol-toml ^1.6.1 override (astro still pins 1.6.0 which has a moderate DoS CVE)
• pnpm-lock.yaml: updated lockfile

Rate Limiter

• src/middleware/rateLimit.ts: fixed fallback key from unique-per-request UUID to shared "unknown" bucket so the limiter is never bypassed when X-Forwarded-For is absent or invalid
• src/middleware/rateLimit.test.ts: added regression test covering the fallback bucket behaviour

Markdown Defense-in-Depth

• src/lib/markdown.ts: explicit scheme allowlist (http:, https:, mailto:, #) in link and image renderers; input trimmed before scheme check to close whitespace bypass

Accessibility & Navigation

• src/components/DocsHeader.astro: aria-expanded/aria-controls on mobile menu button; sidebar inert/aria-hidden synced to menu state; menu auto-closes on resize into desktop viewport
• src/components/DocsToc.tsx: IntersectionObserver entries sorted by DOM position; active heading read from heading.id directly (fixes duplicate-slug collision)
• src/components/ThemeSwitcher.tsx: backdrop changed from focusable button to non-focusable div + aria-hidden; focus moves to current theme on open
• src/components/Search.tsx: result items wrapped in <a href> (tabIndex=-1, stopPropagation) for native middle/Cmd-click; removed unconditional window.location.href that caused double-navigation
• src/pages/content/[...slug].astro: Astro.redirect branches replaced with throw — missing slug/article is a build-time invariant violation on a prerendered route

Test plan

• pnpm test — all 153 tests pass
• pnpm exec tsc --noEmit — no type errors
• pnpm build — clean production build
• pnpm audit — 0 vulnerabilities
• Manual: mobile menu button announces aria-expanded state correctly in a screen reader
• Manual: TOC highlights correct heading when multiple headings share similar text
• Manual: search result middle-click / Cmd-click opens in new tab without double-navigation

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​react@​19.2.16
	lucide-react@​1.17.0
	marked@​18.0.4
	@​types/​node@​25.9.1
	tsx@​4.22.4
	@​astrojs/​node@​10.1.3
	tailwindcss@​4.3.0
	react@​19.2.7
	tailwind-merge@​3.6.0
	astro@​6.4.4
	@​tailwindcss/​vite@​4.3.0
	react-dom@​19.2.7
	@​biomejs/​biome@​2.4.16

View full report

[codecov]

Codecov Report

❌ Patch coverage is 65.00000% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.90%. Comparing base (2502f90) to head (c33412c).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
src/components/Search.tsx	50.00%	4 Missing ⚠️
src/lib/markdown.ts	72.72%	0 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #65      +/-   ##
==========================================
- Coverage   83.33%   82.90%   -0.43%     
==========================================
  Files          11       11              
  Lines         264      275      +11     
  Branches       68       70       +2     
==========================================
+ Hits          220      228       +8     
- Misses         26       28       +2     
- Partials       18       19       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.