Chore: monthly .org update

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,17 +1,23 @@
-## Frameworks PR Checklist
+<!--
+Thanks for contributing! New here? Skim the contributor guide first:
+https://frameworks.securityalliance.dev/contribute/contributing
+-->
 
-Thank you for contributing to the Security Frameworks! Before you open a PR, make sure to read [information for contributors](https://frameworks.securityalliance.dev/contribute/contributing) and take a look at the following checklist:
+### What does this PR change?
+<!-- A short summary: what you changed and why. -->
+<!-- Opened an issue first, or completing one? Add "Closes #123" here so the issue auto-closes when this PR merges. -->
 
-- [ ] Describe your changes, substitute this text with the information
-- [ ] If you are touching an existing piece of content, tag current contributors from the attribution list
-- [ ] If there is a steward for that framework, ask the steward to review it
-- [ ] If you're modifying the general outline, make sure to update it in the `vocs.config.ts` adding the `dev: true` parameter
-- [ ] If you need feedback for your content from the wider community, share the PR in our Discord
-- [ ] Review changes to ensure there are no typos; see instructions below.
+### Type of change
+- [ ] New content
+- [ ] Edit to existing content
+- [ ] Outline / structure change
+- [ ] Typo or formatting fix
+- [ ] Tooling / config
 
-<!--
-ℹ️ Checking for typos locally
-1. Install [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2)
-2. Install [just](https://github.com/casey/just)
-3. Run `npx just lint`
--->
+### If applicable
+- [ ] Editing existing content: tagged the current contributors from the attribution list
+- [ ] Framework has a steward: asked them to review
+- [ ] Outline change: updated `vocs.config.ts` with the `dev: true` parameter
+- [ ] Want community feedback: shared this PR in our Discord
+
+Stuck on anything? Just write it here and we're happy to help.

.github/dependabot.yml

@@ -0,0 +1,97 @@
+version: 2
+
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+
+    target-branch: "develop"
+
+    # Normal version updates only.
+    # Security updates are not delayed by cooldown.
+    cooldown:
+      default-days: 7
+      semver-patch-days: 7
+      semver-minor-days: 14
+      semver-major-days: 30
+
+    open-pull-requests-limit: 5
+
+    # Conservative npm behavior:
+    # do not rewrite package.json ranges unless needed.
+    versioning-strategy: "increase-if-necessary"
+
+    groups:
+      pnpm-patch:
+        applies-to: "version-updates"
+        patterns:
+          - "*"
+        update-types:
+          - "patch"
+
+      pnpm-minor:
+        applies-to: "version-updates"
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+
+    # Block routine major updates.
+    # Handle majors manually / intentionally.
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+
+    commit-message:
+      prefix: "chore(deps)"
+
+    labels:
+      - "dependencies"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+
+    target-branch: "develop"
+
+    cooldown:
+      default-days: 7
+
+    open-pull-requests-limit: 3
+
+    groups:
+      actions-patch:
+        applies-to: "version-updates"
+        patterns:
+          - "*"
+        update-types:
+          - "patch"
+
+      actions-minor:
+        applies-to: "version-updates"
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+
+    commit-message:
+      prefix: "chore(gha)"
+
+    labels:
+      - "dependencies"

.github/release-please/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.0.0"
+}

.github/release-please/release-please-config.json

@@ -0,0 +1,8 @@
+{
+  "packages": {
+    ".": {
+      "release-type": "simple",
+      "component": "Security Frameworks"
+    }
+  }
+}

.github/workflows/md-lint.yaml

@@ -9,8 +9,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: DavidAnson/markdownlint-cli2-action@v20
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd # v23.2.0
       continue-on-error: true
       with:
         globs: |

.github/workflows/preview-build.yml

@@ -14,16 +14,16 @@ jobs:
     name: Build Preview Site
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 1
           persist-credentials: false
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22
           cache: pnpm
@@ -37,10 +37,10 @@ jobs:
           CF_PAGES_BRANCH: ${{ github.head_ref }}
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: preview-build
-          path: docs/dist
+          path: dist/public
           include-hidden-files: true
           if-no-files-found: error
           retention-days: 1

.github/workflows/preview-deploy.yml

@@ -27,7 +27,7 @@ jobs:
       url: ${{ steps.cloudflare-preview-deploy.outputs.alias || steps.cloudflare-preview-deploy.outputs.url }}
     steps:
       - name: Download build artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         id: preview-build-artifact
         with:
           name: preview-build

.github/workflows/release-please.yml

@@ -0,0 +1,21 @@
+name: Release Please
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Create or update release PR
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        with:
+          target-branch: main
+          config-file: .github/release-please/release-please-config.json
+          manifest-file: .github/release-please/.release-please-manifest.json

.github/workflows/s3-upload.yml

@@ -37,7 +37,7 @@ jobs:
       # Step 0: Verify user permissions
       - name: Verify user permissions
         id: check-permissions
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const allowed = ['admin', 'maintain', 'triage'];
@@ -61,7 +61,7 @@ jobs:
 
       # Step 1: Acknowledge the command by adding a reaction
       - name: React to command
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             // Add an "eyes" emoji reaction to the comment to show we're processing
@@ -75,7 +75,7 @@ jobs:
       # Step 2: Extract GitHub image URLs from the comment
       - name: Extract GitHub image URLs
         id: extract-urls
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const comment = context.payload.comment.body;
@@ -193,24 +193,24 @@ jobs:
 
       # Step 4: Checkout repository
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       # Step 5: Setup Node.js and pnpm
       - name: Setup Node.js
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "20"
 
       # Step 6: Install pnpm
       - name: Setup pnpm
-        uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           version: 10.15.0
           run_install: false
 
       # Step 7: Cache pnpm dependencies
       - name: Cache pnpm dependencies
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         id: pnpm-cache
         with:
           path: |
@@ -228,7 +228,7 @@ jobs:
 
       # Step 9: Write URLs to a temp file for the processing script
       - name: Write URLs to file
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
@@ -248,7 +248,7 @@ jobs:
 
       # Step 9b: Configure AWS credentials using OIDC (just-in-time before upload)
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           aws-region: ${{ secrets.AWS_REGION }}
@@ -265,7 +265,7 @@ jobs:
           # Run script and capture output
           TEMP_OUTPUT=$(mktemp)
           set +e
-          node .github/scripts/process-images.js > "$TEMP_OUTPUT" 2>&1
+          node .github/scripts/process-images.cjs > "$TEMP_OUTPUT" 2>&1
           EXIT_CODE=$?
           set -e
 
@@ -296,7 +296,7 @@ jobs:
 
       # Step 11: Comment results back to PR and check for failures
       - name: Comment results and check failures
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           RESULTS_FILE_PATH: ${{ env.RESULTS_FILE_PATH }}
         with:

.github/workflows/spell-check.yml

@@ -17,18 +17,30 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 2
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install
+
       - name: Find and check typos in mdx files
         id: find_typos
         run: |
           echo "Checking for typos..."
           set -o pipefail
           # Run cspell and capture output, but don't fail yet
-          output=$(npx cspell lint "docs/pages/**/*.mdx" --no-progress --no-summary || true)
+          output=$(pnpm exec cspell lint "docs/pages/**/*.mdx" --no-progress --no-summary || true)
 
           if [[ -n "$output" ]]; then
             echo "Typos found, formatting output..."
@@ -50,7 +62,7 @@ jobs:
 
       - name: Comment on pull request
         if: env.TYPOS != ''
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/vocs-config-reminder.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check for added, renamed, or removed documentation files
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             // Sanitize filenames
@@ -141,7 +141,7 @@ jobs:
             ${fileListSection}
 
             Please ensure that:
-            - [ ] The sidebar in \`vocs.config.tsx\` has been updated to include these files
+            - [ ] The sidebar in \`vocs.config.ts\` has been updated to include these files
             - [ ] New content has the \`dev: true\` parameter so it's marked as under development
             - [ ] Sidebar links match the file paths - use the preview deployment to verify
 

.gitignore

@@ -40,9 +40,13 @@ CLAUDE.md
 **/dist/
 
 # Generated printable checklists
-docs/public/printable/
+public/printable/
 
 .direnv
 
 # Avoid submitting certs data to repo
 cert-data.json
+.worktrees/
+
+# vocs/waku auto-generated route types
+docs/pages.gen.ts