[pelikhan]

Summary

Consolidate the remaining open Dependabot npm updates whose exact target versions are available from the Microsoft 1ES public npm feed:

Dependabot PR	Update applied here
#70608	eslint-factory transitive Vite 8.1.0 → 8.3.4
#70492	Astro 7.3.8 → 7.4.0
#70495	@astrojs/markdown-remark 7.3.2 → 7.3.3, including its override
#70494	Vitest 5.0.3 → 5.0.5
#70496	@vitest/ui 5.0.3 → 5.0.5

Also align @vitest/coverage-v8 to 5.0.5 to satisfy its exact Vitest peer requirement. Regenerate dependency lockfiles while preserving existing registry URLs and integrity hashes for unchanged versions; no new 1ES-specific URLs or registry configuration are committed.

Reviewed all 11 open Dependabot PRs. The updates in #70607 (runtime Vite), #70606 (follow-redirects), #70493 (Playwright), and #70489 (starlight-changelogs) are already present on the base branch. Python PRs #70876 and #70485 are outside the 1ES npm feed scope. Existing Dependabot PRs are not modified, merged, or closed by this change.

Validation

• Exact target-version metadata queries succeeded against the 1ES public feed.
• Final npm ci succeeded through the 1ES feed in all three affected package directories, including package downloads and lockfile integrity checks.
• ESLint factory build and all 715 tests passed.
• Runtime TypeScript and session-schema freshness checks passed.
• 569 focused runtime tests passed with the V8 coverage provider enabled; all 458 harness tests passed with a 30-second local test timeout.
• Markdown plugin tests passed.
• Full docs build succeeded (300 pages, internal links valid) using the external githubnext/agentics workflow sources through the same AGENTICS_WORKFLOWS_DIR setting as CI.
• make agent-report-progress passed.

Broad JavaScript-suite limitation: the initial all-files run exceeded the default 10-second timeout in one watchdog test and subsequently stalled in work-queue tests, so it was stopped. The watchdog and complete harness suite pass with the larger local timeout above. The broad suite is not claimed to pass; no unrelated tests or timeout defaults were changed.

[github-actions]

🧠 Matt Pocock Skills Reviewer is reviewing this pull request using Matt Pocock's engineering skills...

[github-actions]

🔬 Test Quality Sentinel is analyzing test quality on this pull request...

[github-actions]

🔎 PR Code Quality Reviewer is reviewing code quality for this pull request...

[github-actions]

🔍 Design Decision Gate 🏗️ is checking for design decision records on this pull request...

[github-actions]

✂️ Ponytail Reviewer has started processing this pull request

[Copilot]

🔵 Needs a closer look

Dependency constraints remain inconsistent, and the broad runtime suite stalled before completion.

4 open issues

• Update magic-string override for Vitest 5 compatibility · New
• Restore SHA-512 integrity hashes for lockfile tarballs · New
• Raise Node.js engine requirement to >=22.22.0 · New
• Update Astro overrides for p-queue and zod minimums · New

3 files not reviewed

• actions/setup/js/package-lock.json: Generated file
• docs/package-lock.json: Generated file
• eslint-factory/package-lock.json: Generated file

What changed in this PR

This dependency-only update consolidates 1ES-supported Dependabot changes for gh-aw’s documentation site and JavaScript tooling.

Changes:

• Upgrade Astro to 7.4.0 and Markdown Remark to 7.3.3, including its override.
• Align Vitest, its UI, and V8 coverage packages at 5.0.5.
• Upgrade ESLint factory’s transitive Vite to 8.3.4 and refresh all three lockfiles.

File	Description
eslint-factory/​package-lock.json	Updates Vite and its transitive dependencies.
docs/​package.json	Updates Astro, Markdown Remark, and its override.
docs/​package-lock.json	Records the updated documentation dependency tree.
actions/​setup/​js/​package.json	Aligns Vitest and companion package requirements.
actions/​setup/​js/​package-lock.json	Locks the updated JavaScript test-tooling dependencies.

_{Review effort: Max}

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.93.1