Merge pull request 'chore: update dependencies for security' (#8) from chore/issue-7-deps-security into develop

Reviewed-on: #8

.gitignore

@@ -6,6 +6,14 @@ dist/
 # dependencies
 node_modules/
 
+# Podman / Compose
+.env.podman
+
+# Nix
+.direnv/
+.result
+result
+
 # logs
 npm-debug.log*
 yarn-debug.log*

Containerfile

@@ -0,0 +1,15 @@
+# syntax=docker/dockerfile:1
+FROM node:lts-bookworm-slim
+
+WORKDIR /app
+
+# Install dependencies first (better layer caching)
+COPY package.json package-lock.json ./
+RUN npm ci
+
+# Copy the rest of the project
+COPY . .
+
+EXPOSE 4321
+
+CMD ["npm","run","dev","--","--host","0.0.0.0","--port","4321"]

README.md

@@ -14,3 +14,56 @@ All commands are run from the root of the project, from a terminal:
 | `npm run preview`         | Preview your build locally, before deploying     |
 | `npm run astro ...`       | Run CLI commands like `astro add`, `astro check` |
 | `npm run astro -- --help` | Get help using the Astro CLI                     |
+
+## Dependency update guidance
+
+For security/deprecated remediation, allow breaking changes via `npm audit fix --force`, then verify:
+
+- `npm audit`
+- `npm run build`
+
+## Nix devshell (recommended)
+
+If you use Nix, you can enter a dev shell that provides the required CLI tools for this repo:
+
+```sh
+nix develop
+```
+
+This is intended to provide tools like Forgejo CLI (`fj`) and Node.js so "when you enter the repo, everything is available":
+
+```sh
+nix develop --command fj version
+nix develop --command node --version
+```
+
+## Podman (container) development
+
+This repo can be developed inside a Podman container to keep your host clean and improve reproducibility.
+
+### Using podman compose
+
+```sh
+podman compose up --build
+```
+
+On WSL2/rootless Podman, if you hit netavark/nftables errors, this repo defaults to `slirp4netns` via `network_mode` in `compose.yml`.
+
+Then open: http://localhost:4321
+
+Run other commands in the running container:
+
+```sh
+podman compose exec app npm run build
+podman compose exec app npm run preview -- --host 0.0.0.0 --port 4321
+```
+
+### Troubleshooting (WSL2)
+
+If hot reload is unstable/slow, enable polling:
+
+```sh
+CHOKIDAR_USEPOLLING=1 podman compose up --build
+```
+
+Tip: placing the repo under the WSL filesystem (e.g. `~/project/...`) is often faster than under `/mnt/c`.

astro.config.mjs

@@ -5,6 +5,6 @@ import preact from "@astrojs/preact";
 
 // https://astro.build/config
 export default defineConfig({
-  site: "https://example.com",
+  site: "https://blog.n-daisuke897.com/",
   integrations: [preact()]
 });

compose.yml

@@ -0,0 +1,16 @@
+services:
+  app:
+    build:
+      context: .
+      dockerfile: Containerfile
+    # WSL2/rootless: avoid netavark+nftables bridge rules by using slirp4netns
+    network_mode: "slirp4netns:allow_host_loopback=true"
+    ports:
+      - "4321:4321"
+    volumes:
+      - .:/app
+      - node_modules:/app/node_modules
+    command: npm run dev -- --host 0.0.0.0 --port 4321
+
+volumes:
+  node_modules:

flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1769598131,
+        "narHash": "sha256-e7VO/kGLgRMbWtpBqdWl0uFg8Y2XWFMdz0uUJvlML8o=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "fa83fd837f3098e3e678e6cf017b2b36102c7211",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,23 @@
+{
+  description = "Naputo blog devshell";
+
+  inputs = {
+    # Use stable nixpkgs for a more predictable toolchain.
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = import nixpkgs { inherit system; };
+      in
+      {
+        devShells.default = pkgs.mkShell {
+          packages = with pkgs; [
+            forgejo-cli
+            nodejs
+          ];
+        };
+      });
+}

package.json

@@ -10,21 +10,22 @@
   },
   "dependencies": {
     "@astrojs/preact": "^4.1.3",
-    "@astrojs/rss": "^4.0.14",
+    "@astrojs/rss": "^4.0.15",
-    "astro": "^5.7.5",
+    "astro": "^5.17.1",
-    "preact": "^10.28.0"
+    "preact": "^10.28.3"
   },
   "devDependencies": {
-    "@astrojs/language-server": "^2.16.2",
+    "@astrojs/language-server": "^2.13.4",
     "@astrojs/ts-plugin": "^1.10.6",
+    "@typescript-eslint/eslint-plugin": "^8.54.0",
+    "@typescript-eslint/parser": "^8.54.0",
+    "astro-eslint-parser": "^1.2.2",
+    "eslint": "^9.39.2",
+    "eslint-plugin-astro": "^1.5.0",
+    "eslint-plugin-react": "^7.37.5",
+    "eslint-plugin-react-hooks": "^7.0.1",
     "typescript": "^5.9.3",
     "typescript-language-server": "^5.1.3",
-    "@typescript-eslint/parser": "^8.0.0",
-    "@typescript-eslint/eslint-plugin": "^8.0.0",
-    "eslint-plugin-react": "^7.35.0",
-    "eslint-plugin-react-hooks": "^7.0.1",
-    "eslint-plugin-astro": "^1.5.0",
-    "astro-eslint-parser": "^1.2.2",
     "vscode-langservers-extracted": "^4.10.0"
   }
 }