chore(deps): audit + bump vulnerable/outdated deps; add minimumReleaseAge guard; docs accuracy pass

.github/dependabot.yml

@@ -0,0 +1,32 @@
+# Dependabot config — aligned with the PMDS sibling repos (Aurelius, Claudius,
+# Flavian, Nerva; structure mirrors Nerva's). The `cooldown` blocks are the
+# Dependabot equivalent of Renovate's `minimumReleaseAge` guard: new releases
+# must age before Dependabot proposes them, which blunts supply-chain attacks
+# that get yanked within days of publish.
+#
+# NOTE: Dependabot alerts require Dependency graph to be enabled in
+# Settings → Security (owner action — see issue #2).
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(deps):"
+    cooldown:
+      default-days: 7
+      semver-major-days: 14
+    groups:
+      minor-and-patch:
+        update-types: ["minor", "patch"]
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "ci(deps):"
+    cooldown:
+      default-days: 7

.github/workflows/canva-pipeline.yml

@@ -68,7 +68,8 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Install jq
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq jq
+        # jq is preinstalled on GitHub-hosted runners; apt is a flaky fallback only
+        run: command -v jq >/dev/null 2>&1 || (sudo apt-get update -qq && sudo apt-get install -y -qq jq)
 
       # The hard gate: fixture scripts match their goldens, the token set
       # compiles into a valid BuildPlan, and the plan applies cleanly with

.github/workflows/pipeline-tests.yml

@@ -48,9 +48,8 @@ jobs:
           submodules: recursive
 
       - name: Install jq
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y -qq jq
+        # jq is preinstalled on GitHub-hosted runners; apt is a flaky fallback only
+        run: command -v jq >/dev/null 2>&1 || (sudo apt-get update -qq && sudo apt-get install -y -qq jq)
 
       - name: Make scripts executable
         run: |

.github/workflows/site-validation.yml

@@ -71,7 +71,8 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Install jq
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq jq
+        # jq is preinstalled on GitHub-hosted runners; apt is a flaky fallback only
+        run: command -v jq >/dev/null 2>&1 || (sudo apt-get update -qq && sudo apt-get install -y -qq jq)
 
       - name: Lint the committed BuildPlan fixtures
         run: |

.github/workflows/validate-configs.yml

@@ -23,7 +23,8 @@ jobs:
           submodules: true
 
       - name: Install jq
-        run: sudo apt-get install -y jq
+        # jq is preinstalled on GitHub-hosted runners; apt is a flaky fallback only
+        run: command -v jq >/dev/null 2>&1 || (sudo apt-get update -qq && sudo apt-get install -y -qq jq)
 
       - name: Run validation tests
         run: tests/bats/bin/bats tests/validate-agent-configs.bats

README.md

@@ -1,5 +1,12 @@
 # Vespasian
 
+[![Release](https://img.shields.io/github/v/release/PMDevSolutions/Vespasian)](https://github.com/PMDevSolutions/Vespasian/releases)
+[![Pipeline tests](https://github.com/PMDevSolutions/Vespasian/actions/workflows/pipeline-tests.yml/badge.svg)](https://github.com/PMDevSolutions/Vespasian/actions/workflows/pipeline-tests.yml)
+[![Security audit](https://github.com/PMDevSolutions/Vespasian/actions/workflows/security-audit.yml/badge.svg)](https://github.com/PMDevSolutions/Vespasian/actions/workflows/security-audit.yml)
+[![Node](https://img.shields.io/badge/node-%3E%3D20-brightgreen)](https://nodejs.org/)
+[![pnpm](https://img.shields.io/badge/pnpm-9.x-f69220)](https://pnpm.io/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+
 **Claude Code-integrated Wix site builder — design in (Figma · Canva · InDesign), live Wix site out.**
 
 Vespasian converts a design — a Figma URL, a Canva HTML/CSS export, or an InDesign document — into a live **Wix Studio** site. It extracts design tokens with full provenance, compiles a serializable **BuildPlan**, and applies it to a real Wix site: official Wix REST APIs first, the Wix CLI/Git integration for custom CSS and code, and Playwright-driven editor automation only where no API exists. Vespasian is a fork of [Flavian](https://github.com/PMDevSolutions/Flavian) (the same pipeline targeting WordPress), sharing its design-ingestion front end unchanged.

package.json

@@ -54,18 +54,24 @@
   },
   "devDependencies": {
     "@clack/prompts": "^0.7.0",
-    "@commitlint/cli": "^19.5.0",
-    "@commitlint/config-conventional": "^19.5.0",
+    "@commitlint/cli": "^19.8.1",
+    "@commitlint/config-conventional": "^19.8.1",
     "@lhci/cli": "^0.14.0",
-    "pixelmatch": "^7.1.0",
-    "playwright": "1.60.0",
+    "pixelmatch": "^7.2.0",
+    "playwright": "1.61.1",
     "pngjs": "^7.0.0"
   },
   "pnpm": {
     "overrides": {
       "tmp": ">=0.2.6",
       "uuid": ">=11.1.1",
-      "cookie": ">=0.7.0"
+      "cookie": ">=0.7.0 <1",
+      "esbuild": ">=0.28.1",
+      "js-yaml@3": ">=3.15.0 <4",
+      "js-yaml@4": ">=4.2.0 <5",
+      "tar": ">=7.5.16",
+      "ws@7": ">=7.5.11 <8",
+      "ws@8": ">=8.21.0 <9"
     }
   }
 }

packages/gui/package.json

@@ -26,20 +26,20 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.39.4",
-    "@types/node": "^22.0.0",
-    "@types/react": "^18.3.0",
-    "@types/react-dom": "^18.3.0",
-    "@vitejs/plugin-react": "^4.3.0",
-    "electron": "^39.8.5",
-    "electron-builder": "^25.0.0",
+    "@types/node": "^22.20.0",
+    "@types/react": "^18.3.31",
+    "@types/react-dom": "^18.3.7",
+    "@vitejs/plugin-react": "^4.7.0",
+    "electron": "^39.8.10",
+    "electron-builder": "^25.1.8",
     "electron-vite": "^2.3.0",
     "eslint": "^9.39.4",
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-hooks": "^7.1.1",
-    "playwright": "1.60.0",
-    "tsx": "^4.19.0",
-    "typescript": "^5.6.0",
-    "typescript-eslint": "^8.61.1",
+    "playwright": "1.61.1",
+    "tsx": "^4.23.0",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.63.0",
     "vite": "^6.4.3"
   }
 }

packages/pipeline/package.json

@@ -20,10 +20,10 @@
     "stage-assets": "node bin/stage-assets.mjs"
   },
   "dependencies": {
-    "fast-xml-parser": "^5.7.0",
-    "fflate": "^0.8.2",
+    "fast-xml-parser": "^5.9.3",
+    "fflate": "^0.8.3",
     "pdfjs-dist": "^4.10.38",
-    "zod": "^3.23.8"
+    "zod": "^3.25.76"
   },
   "engines": {
     "node": ">=20.0.0"

packages/wix-driver/package.json

@@ -11,10 +11,10 @@
 		"test": "node --test"
 	},
 	"dependencies": {
-		"zod": "^3.23.8"
+		"zod": "^3.25.76"
 	},
 	"devDependencies": {
-		"playwright": "1.60.0"
+		"playwright": "1.61.1"
 	},
 	"engines": {
 		"node": ">=20.0.0"