mirror of
https://github.com/Fission-AI/OpenSpec.git
synced 2026-10-19 06:10:10 +08:00
`pnpm start` ran `serve`, a dev-only tool whose transitive tree kept publishing advisories into the docs site's graph. Four of them had to be pinned by hand in #2019 (brace-expansion x3, fast-uri) after the Security workflow went red on main, for code that never reached the published site. Replace it with a first-party static preview script, which has no tree to audit, and drop the three pins that existed only to patch serve's tree (brace-expansion, fast-uri, compression). The build-time pins (postcss, sharp, nanoid) stay. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>