chore: upgrade deps, migrate theme to TypeScript, and fix security advisories (#18)

Bump vite/esbuild via pnpm overrides to resolve GHSA advisories, add SECURITY.md and Dependabot, and convert the VitePress theme entry from JS to TS.

Author: yanglbme

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      vitepress:
+        patterns:
+          - vitepress*
+          - vite*
+          - vue*
+          - typescript
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/compress.yml

@@ -16,7 +16,7 @@ jobs:
     if: github.repository == 'doocs/coding-interview'
     steps:
       - name: Checkout Branch
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: Compress Images
         id: calibre

.github/workflows/prettier.yml

@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           ref: ${{ github.head_ref }}
 

SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| main    | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+This project is a static documentation site built with [VitePress](https://vitepress.dev/). It does not run a backend service or process untrusted user input on a server.
+
+If you discover a security issue in this repository (for example, a dependency vulnerability, leaked secret, or unsafe workflow configuration), please report it responsibly:
+
+1. **Do not** open a public GitHub issue for security-sensitive reports.
+2. Email the maintainers at [szuyanglb@outlook.com](mailto:szuyanglb@outlook.com) with a description of the issue, steps to reproduce, and potential impact.
+3. You can also use [GitHub Private Vulnerability Reporting](https://github.com/doocs/coding-interview/security/advisories/new) if enabled for this repository.
+
+We aim to acknowledge reports within 7 days and will coordinate a fix and disclosure timeline with you.
+
+## Dependency Security
+
+Dependency updates and known vulnerability fixes are tracked via Dependabot and `pnpm audit`. Pull requests that bump vulnerable transitive dependencies are welcome.

docs/.vitepress/env.d.ts

@@ -0,0 +1,7 @@
+/// <reference types="vite/client" />
+
+declare module "*.vue" {
+  import type { DefineComponent } from "vue";
+  const component: DefineComponent<object, object, unknown>;
+  export default component;
+}

docs/.vitepress/theme/index.js docs/.vitepress/theme/index.tsdocs/.vitepress/theme/index.js renamed to docs/.vitepress/theme/index.ts

@@ -1,3 +1,4 @@
+import type { Theme } from "vitepress";
 import DefaultTheme from "vitepress/theme";
 import giscusTalk from "vitepress-plugin-comment-with-giscus";
 import { useData, useRoute } from "vitepress";
@@ -6,7 +7,7 @@ import Layout from "./Layout.vue";
 
 export default {
   extends: DefaultTheme,
-  Layout: Layout,
+  Layout,
   enhanceApp(ctx) {
     DefaultTheme.enhanceApp(ctx);
   },
@@ -35,4 +36,4 @@ export default {
       true
     );
   },
-};
+} satisfies Theme;

package.json

@@ -1,11 +1,15 @@
 {
   "devDependencies": {
-    "vitepress": "^2.0.0-alpha.17"
+    "typescript": "^5.9.3",
+    "vitepress": "^2.0.0-alpha.17",
+    "vue": "^3.5.32",
+    "vue-tsc": "^3.0.8"
   },
   "scripts": {
     "docs:dev": "vitepress dev docs",
     "docs:build": "vitepress build docs",
-    "docs:preview": "vitepress preview docs"
+    "docs:preview": "vitepress preview docs",
+    "docs:typecheck": "vue-tsc --noEmit"
   },
   "dependencies": {
     "vitepress-plugin-comment-with-giscus": "^1.1.15"