chore(deps): clear Dependabot security alerts (#385)

* chore(deps): clear Dependabot security alerts

Bumps transitive dev dependencies via npm audit fix and upgrades two
direct devDependencies whose patched versions required a major bump:

- css-minimizer-webpack-plugin: ^7.0.2 → ^8.0.0 (clears serialize-javascript
  RCE/DoS advisories GHSA-5c6j-r48x-rmvq, GHSA-qj8w-gfj5-8c6v)
- sass: ^1.94.2 → ^1.99.0 (clears immutable prototype-pollution
  advisory GHSA-wf6x-7x77-mvgw)

`npm audit` now reports 0 vulnerabilities. All affected packages are
dev/build-time only; no runtime/shipped code is changed.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* ci: bump Node to 20 for css-minimizer-webpack-plugin@8 engine requirement

css-minimizer-webpack-plugin@8 and serialize-javascript@7 require Node
>= 20. Bumps sphinx-theme-builder's nodeenv pin from 18.18.0 to 20.18.0
and the matching setup-node version across CI/docs/update-snapshots
workflows. Without this, the editable install fails with
'ReferenceError: crypto is not defined' inside serialize-javascript.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* ci: bump .nvmrc and contributor docs to Node 20.18.0

Completes the Node 20 migration flagged by Copilot review on PR #385.
Aligns .nvmrc, CONTRIBUTING.md, and docs/developer/setup.md with the
sphinx-theme-builder node-version pin and the CI setup-node version.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Author: mmcky

.github/workflows/ci.yml

@@ -43,7 +43,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '18'
+          node-version: '20'
           cache: 'npm'
       - name: Install Playwright
         run: |

.github/workflows/docs.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: "18"
+          node-version: "20"
           cache: "npm"
 
       - name: Install Node.js dependencies and build assets

.github/workflows/update-snapshots.yml

@@ -62,7 +62,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '18'
+          node-version: '20'
           cache: 'npm'
 
       - name: Install Playwright
@@ -169,7 +169,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '18'
+          node-version: '20'
           cache: 'npm'
 
       - name: Install Playwright

.nvmrc

@@ -1 +1 @@
-18.18.0
+20.18.0

CONTRIBUTING.md

@@ -16,7 +16,7 @@ Thank you for your interest in contributing to the QuantEcon Book Theme! This do
 ### Prerequisites
 
 - Python 3.12 or higher
-- Node.js 18.18.0 or higher (see `.nvmrc`)
+- Node.js 20.18.0 or higher (see `.nvmrc`)
 - Git
 
 ### Initial Setup

docs/developer/setup.md

@@ -5,7 +5,7 @@ Set up a local development environment for `quantecon-book-theme`.
 ## Prerequisites
 
 - **Python 3.12 or newer**
-- **Node.js 18.18.0 or newer** — for compiling SCSS/JS assets with webpack
+- **Node.js 20.18.0 or newer** — for compiling SCSS/JS assets with webpack
 - **Git**
 
 ## Initial Setup

package-lock.json

@@ -9,11 +9,11 @@
     "devDependencies": {
         "@playwright/test": "^1.49.0",
         "css-loader": "^7.1.2",
-        "css-minimizer-webpack-plugin": "^7.0.2",
+        "css-minimizer-webpack-plugin": "^8.0.0",
         "dedent": "^1.7.0",
         "html-webpack-plugin": "^5.6.5",
         "mini-css-extract-plugin": "^2.9.4",
-        "sass": "^1.94.2",
+        "sass": "^1.99.0",
         "sass-loader": "^16.0.6",
         "webpack": "^5.103.0",
         "webpack-cli": "^6.0.1",

package.json

@@ -3,7 +3,7 @@ requires = ["sphinx-theme-builder >= 0.2.0a7"]
 build-backend = "sphinx_theme_builder"
 
 [tool.sphinx-theme-builder]
-node-version = "18.18.0"
+node-version = "20.18.0"
 theme-name = "quantecon_book_theme"
 additional-compiled-static-assets = [
   "locales/"