Repository navigation
Update to rid ourselves of all security and quality alerts - #1301
Merged
Merged
Conversation
Neither is imported anywhere. hast on npm is not the HTML syntax tree types (that's @types/hast), but the 2016 name of what became rehype. It was the only thing pulling in trim 0.0.1, which has an open high-severity ReDoS alert. sharp 0.34.5 is not what Astro uses for images: Astro depends on sharp ^0.35.4 and gets its own copy. The top-level one only added three open high-severity alerts.
src/lib/nixpkgs-doc.ts imports node:fs/promises and node:path and reads process.env, so astro check needs Node's type definitions. They only arrived by accident, through @types/yauzl, which extract-zip pulls in via the Netlify adapter's tooling. Updating that tooling drops extract-zip, and astro check then fails with "Cannot find module 'node:path'". The 26.x types match site/.node-version. The locked version is unchanged.
npm update, which picks up the fixed releases of nearly every package with an open Dependabot alert. Among others: @astrojs/netlify 8.2.10, vite 8.3.5, devalue 5.9.4, svgo 4.1.0, sharp 0.35.5 (Astro's copy), http-cache-semantics 4.3.0 and fast-uri 3.1.9. The updated Netlify tooling no longer pulls in extract-zip or node-forge at all. Astro is held at 7.3.x: 7.4.2, the newest 7.4 release, fails to build the site with CannotFetchFontFile, because the npm font provider with remote: false now fetch()es a file:// URL (node_modules/inter-ui/variable/ InterVariable.woff2), which Node's fetch doesn't support. 7.3.8 builds. prettier, astro check, astro build and astro dev all work, including the server-rendered Nixpkgs manual pages.
The site served the full Inter variable fonts, 344 KiB upright and 379 KiB italic, and preloaded both on every page. inter-ui also ships a Latin subset (variable-latin/), 97 KiB upright and 107 KiB italic. Unlike the Fontsource and Google Fonts subsets, it keeps Inter's OpenType features (37 of 39, including the dlig the site turns on) and both variation axes, so text looks the same. Of the roughly 790,000 prose characters in the site and the Nixpkgs manual sources, the subset lacks only 14 that the full font has: → (12 times, in two files), ⁵ and ⁷. Those fall back to the system font. The local provider takes the files as package imports, so they still come from the inter-ui package and Dependabot keeps them updated. It also avoids the npm provider's remote: false path, which breaks in Astro 7.4. Only the upright face is preloaded now; the italic one loads on pages that use it. Preloaded fonts per page go from 770 KiB to 145 KiB.
Fontsource's API serves the same files as @fontsource-variable/fira-code (the Latin file is byte-identical), and the fontsource provider fills in each subset's unicode-range itself, so the npm package can go. The provider fetches the files at build time; that takes a few seconds. Only the latin, latin-ext and symbols2 subsets are requested. Together they cover every character in the code on the site and in the Nixpkgs manual sources, including the box-drawing characters in directory trees. The Cyrillic and Greek subsets weren't used. Also correct the family's settings. It asked for weights 100-900 and an italic style, but the font has 300-700 and no italic (Astro 7.4 warns about both). Its featureSettings 'dlig' did nothing, since Fira Code's files have no dlig feature; its coding ligatures come from calt, which stays on. The size-matched fallback is now based on monospace (Courier New, at about 100% size) instead of the default sans-serif (Arial, at 135%), so code no longer reflows when the font arrives.
Both Route159 faces are preloaded on every page. Re-encoding them from WOFF to WOFF2 makes them 22-23% smaller (47 KiB to 37 KiB), with the same glyphs, outlines, metrics and names; Astro's size-matched fallbacks come out identical. WOFF2 drops the DSIG table (a signature that wouldn't match the re-encoded file anyway) and sets the head flag that marks the lossless transform. The SIL Open Font License, under which Route159 is published, allows this. Converted with fontTools: TTFont(path, recalcTimestamp=False) with flavor = "woff2".
The site was held at Astro 7.3.x because 7.4 broke its fonts: with unifont 1.x, the npm font provider (remote: false) returns file:// URLs, and Astro's font fetcher only reads plain absolute paths from disk and passes everything else to fetch(), which can't read file:// URLs. Neither font uses the npm provider any more, so 7.4.2 builds. prettier, astro check, astro build and astro dev all work, the font output is unchanged, and the Dependabot alert check is the same as on 7.3.8 (48 of the 52 open alerts fixed).
philiptaron
changed the title
Contributor
|
Hey thanks! Just about fontProvider: if the fontsource provider fetches at build time, does that not break in the nix build env? I ran into this a while ago on a different site (so it may have changed), which is why I did the local package trick. |
Collaborator
Author
|
Thanks for the note -- what do you think of this? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Read commit-by-commit.