fix(web): keep report generation on patched dependencies

[vincentkoc]

What Problem This Solves

Fixes an issue where Kova's report-site lock retained vulnerable Astro, URL parsing, image processing, CSS, SVG, and build-tool dependencies.

Why This Change Was Made

The report site moves from Astro 6.4 to Astro 7.1 and pins the transitive packages whose upstream ranges still resolve below the published security floors. The existing static-site configuration and content pipeline remain unchanged.

User Impact

Published Kova reports build with patched dependencies and retain the same static pages, generated OG images, and content validation behavior.

Evidence

• npm audit --audit-level=low: 0 vulnerabilities
• npm test: 6 passed
• npm run check: 0 errors
• npm run build: 18 pages built
• npm run check:web-payload: 1 ok / 0 fail
• git diff --check
• autoreview: clean, no accepted/actionable findings

[clawsweeper]

Codex review: needs changes before merge. Reviewed July 28, 2026, 2:55 AM ET / 06:55 UTC.

ClawSweeper review

What this changes

The PR upgrades Kova’s Astro-based report site from Astro 6 to Astro 7, refreshes its lockfile, and pins fast-uri, sharp, and svgo through npm overrides.

Merge readiness

⚠️ Ready for maintainer review - 3 items remain

Keep this draft PR open for normal review. The dependency update targets a concrete report-site security concern, but the branch also edits the release-owned changelog and the major Astro upgrade still needs report-output and payload validation on the final head.

Priority: P2
Reviewed head: 653ae67ed29fea43a4517712406050ea53f35a7f

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The PR has a focused security-maintenance intent, but it needs the release-owned changelog removal and final report-site compatibility confirmation before it is quality-ready.
Proof confidence	🌊 off-meta tidepool	Not applicable: The external-contributor real-behavior-proof gate does not apply because the PR author is a repository member; the reported audit and build commands remain useful supplemental validation.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The external-contributor real-behavior-proof gate does not apply because the PR author is a repository member; the reported audit and build commands remain useful supplemental validation.
Evidence reviewed	4 items	PR dependency scope: The submitted manifest changes the direct report-site dependency from Astro 6.4.8 to 7.1.4 and adds overrides for fast-uri, sharp, and svgo; the accompanying lockfile refresh is large but confined to the report-site dependency graph. Release-owned file changed: The branch adds a release-note entry to CHANGELOG.md, although repository review policy reserves that file for release ownership rather than normal PRs. Submitted validation context: The PR body reports npm audit, tests, type checking, build, payload checking, and whitespace checks, but the supplied check state still has both macOS and Ubuntu test runs in progress.
Findings	1 actionable finding	[P2] Remove the release-owned changelog edit
Security	None	None.

How this fits together

Kova generates validation reports and the report site renders those results as static pages, including generated Open Graph images. The site’s package manifest and lockfile determine the build toolchain and image/SVG processing dependencies used to publish those reports.

flowchart LR
  A[Kova scenario reports] --> B[Report site content pipeline]
  B --> C[Astro static-site build]
  C --> D[Image and SVG processing]
  D --> E[Published report pages]
  F[Package manifest and lockfile] --> C
  F --> D

Loading

Before merge

• Remove the release-owned changelog edit (P2) - CHANGELOG.md is release-owned under the repository review policy, so this normal dependency PR should not add its own release note. Keep the dependency manifest and lockfile change focused; release owners can capture the note when preparing a release.
• Resolve merge risk (P1) - Astro 7 is a major-version upgrade; report rendering, generated OG images, and the static payload contract should be verified on the exact final dependency graph before merge.
• Resolve merge risk (P1) - The npm overrides force transitive package versions, so a successful fresh build alone is not enough if generated report output or payload validation changes unexpectedly.

Findings

• [P2] Remove the release-owned changelog edit — CHANGELOG.md:9

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency surface	1 direct major upgrade, 3 npm overrides, 1 refreshed lockfile	The change is small at the manifest layer but materially replaces the report-site build graph.
Files affected	3 files affected; 1,341 additions and 1,773 deletions	Most churn is lockfile resolution, making focused output validation more informative than line-count review.

Merge-risk options

Maintainer options:

1. Keep the dependency refresh narrowly scoped (recommended)
   Remove the release-owned changelog entry, then verify a representative report build and payload check against the upgraded Astro and overridden dependencies before merging.
2. Accept the upgrade risk explicitly
   Maintainers may retain the major Astro upgrade if they accept responsibility for any report-site rendering or generated-image compatibility changes.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Remove the release-owned CHANGELOG.md entry, retain the dependency update, and verify the report-site build and payload check on the revised head.

Technical review

Best possible solution:

Land the minimal manifest and lockfile upgrade only after removing the release-owned changelog edit and confirming that a representative report build preserves generated pages, OG images, and the payload check on the final head.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR addresses dependency security floors rather than a user-reported runtime reproduction. The supplied PR body identifies the affected report-site dependency graph and lists audit/build checks.

Is this the best way to solve the issue?

Unclear until final-head output validation is visible: upgrading the direct dependency and constraining vulnerable transitive versions is a maintainable approach, but the release-owned changelog edit should be removed and the major-version build compatibility confirmed.

Full review comments:

• [P2] Remove the release-owned changelog edit — CHANGELOG.md:9
CHANGELOG.md is release-owned under the repository review policy, so this normal dependency PR should not add its own release note. Keep the dependency manifest and lockfile change focused; release owners can capture the note when preparing a release.
  Confidence: 0.96

Overall correctness: patch is incorrect
Overall confidence: 0.78

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 417f7010095b.

Labels

Label changes:

• add P2: This is a bounded report-site dependency security update with compatibility validation still needed before landing.
• add merge-risk: 🚨 compatibility: Upgrading Astro across a major version and forcing image/SVG-related transitive versions can alter existing report builds or generated output.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The external-contributor real-behavior-proof gate does not apply because the PR author is a repository member; the reported audit and build commands remain useful supplemental validation.

Label justifications:

• P2: This is a bounded report-site dependency security update with compatibility validation still needed before landing.
• merge-risk: 🚨 compatibility: Upgrading Astro across a major version and forcing image/SVG-related transitive versions can alter existing report builds or generated output.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The external-contributor real-behavior-proof gate does not apply because the PR author is a repository member; the reported audit and build commands remain useful supplemental validation.

Evidence

Acceptance criteria:

• [P1] git diff --check.
• [P1] npm test.
• [P1] npm run check.
• [P1] npm run build.
• [P1] npm run check:web-payload.

What I checked:

• PR dependency scope: The submitted manifest changes the direct report-site dependency from Astro 6.4.8 to 7.1.4 and adds overrides for fast-uri, sharp, and svgo; the accompanying lockfile refresh is large but confined to the report-site dependency graph. (web/package.json:15, 653ae67ed29f)
• Release-owned file changed: The branch adds a release-note entry to CHANGELOG.md, although repository review policy reserves that file for release ownership rather than normal PRs. (CHANGELOG.md:9, 653ae67ed29f)
• Submitted validation context: The PR body reports npm audit, tests, type checking, build, payload checking, and whitespace checks, but the supplied check state still has both macOS and Ubuntu test runs in progress. (653ae67ed29f)
• History availability: A read-only local history inspection was attempted, but the execution sandbox failed before starting the command; ownership confidence therefore relies only on the supplied PR metadata.

Likely related people:

• vincentkoc: The supplied PR metadata identifies this member as author of the sole dependency-update commit; no local history result was available to establish longer-term ownership of the report-site dependency surface. (role: current dependency-update contributor; confidence: low; commits: 653ae67ed29f; files: web/package.json, web/package-lock.json)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Remove the CHANGELOG.md entry from the branch.
• On the revised head, retain visible validation for the report build, generated output or OG images, and check:web-payload after the Astro 7 upgrade.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix(web): keep report generation on patched dependencies This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.