Refined-X v2.1.1

Refined-X 2.1.1 fixes known dependency vulnerabilities in both the site and optional Worker, and protects asset inputs during cleanup and native encoder upgrades.

Security and compatibility

• Site: Astro 7.3.3, Sharp 0.35.5 and patched compatible transitive dependencies. Pagefind 1.5.2 and Starlight 0.42.0 remain unchanged.
• Worker: MCP client/server 2.3.0 and Wrangler 4.153.0, with patched Sharp 0.35.5, Undici 7.30.1 and Zod. Existing Worker APIs and compatibility date remain unchanged.
• Both complete npm audits report zero known vulnerabilities, including development dependencies. CI now audits both packages at all severities.
• The fresh baseline was 52 GitHub alerts (33 site, 19 Worker), versus the earlier push summary's 22. Each baseline alert was mapped to safe resolved versions; no alerts were dismissed or suppressed.

Asset safety

• Reject overlapping asset source/output roots and dangerous directory/file aliases before cleanup. Preserve declared Markdown and history manifest/blob inputs, while allowing content roots that contain the public directory.
• Image cache v3 includes platform and Sharp/native-library versions. Current cold, upgraded-cache and warm outputs match; original and content-addressed public URLs remain supported.

Validation

• 134 site tests and 175 Worker tests passed, including 100 native Pagefind generations, actual build fault injection, request-isolation/authentication checks, and modern plus legacy MCP protocol calls under local workerd.
• Root and /blog/ builds and output verification passed; an independent clean installation also passed.
• Chromium verified Pagefind result fragments, static Ask search and article navigation, mobile theme rendering, RSS and self-hosted fonts.
• Typechecks and Worker dry-run packaging passed. Four pre-existing Astro hints and 28 demo editorial metadata warnings remain; they are not dependency vulnerabilities.

Install the site and Worker independently with npm ci and rerun npm audit. Instances must regenerate Worker types and run the protocol tests before deployment. This release does not deploy an existing Worker or downstream blog. Windows, real-model calls, fresh external product-client acceptance and downstream CDN behavior are outside this acceptance.

See CHANGELOG and security upgrade notes for exact versions, primary advisory sources and upgrade boundaries.