[rmcdaniel]

The docs dependency tree resolves every open copy to 11.0.2, and the existing dependency-security preflight rejects root or nested copies below v11 before build/start. A small Docusaurus patch preserves custom browsers and aliases through the new named apps export while retaining the default callable. No parent major upgrade is needed on the supported Node 24 line.

Refs #411. Keep the issue open through normal Pages deployment and installed-site acceptance.

Validation:

• Clean npm ci on Node24.22.1 applies all five repository patches.
• Existing dependency-security and Node-toolchain checks and npm test pass.
• The new actual-helper custom-browser regression fails before the Docusaurus patch; custom, alias and default launch controls pass afterward with captured child processes.
• Actual loopback-only npm run start serves the homepage and introduction with HTTP200; its real launch receives exactly the locally constructed documentation URL. Linux execution only; Windows/WSL URL construction was inspected, and no exploit or OS-browser execution is claimed.
• Final-head full build40932243502 and all11 checks pass. Normal publisher40933227718, exact Pages build40934331146 and live routes/assets acceptance pass; task cleanup is verified.

Audit follow-through: the read-only audit at October29 18:29UTC reported 27 findings (22 low, 3 moderate, 2 high, zero critical), with open absent. The affected dependency entries are unchanged from the base; Security tracks the separate build/development fixes and disposition in #413. This PR does not claim a clean dependency audit. Security final acceptance verifies the exact source, normal CI, Pages artifact and live bytes. Sonar now reports zero open findings after the three existing cases were given explicit Node test declarations.

[rmcdaniel]

Security source review on exact head bd8d147b82a7f5de8bb3c6c5df7f986f65f5dc35 / tree f7dbb57d328b615372ce53f26512d5d08d2bba3e: no security finding.

The eight-file PR exactly matches the reviewed commit. It removes every locked open copy below v11, enforces the floor recursively, preserves Docusaurus custom/alias/default launch behavior through the v11 namespace API, and tests the real helper through captured child processes without shell: true. The recorded clean-install, five-patch postinstall, dependency-security/toolchain/test, before-control, and bounded loopback-start receipts satisfy the local source qualification described in #411.

This is conditional source acceptance. The hosted executable-documentation/full-build checks and deployed Pages acceptance are still pending, so #411 should remain open through that evidence. The bounded reachability disposition is unchanged: no production exploit path, release hold, Windows execution claim, or operator action.

[rmcdaniel]

Security narrow recheck on final head 0de03b759140f3ff9e28a6cdd7cc7aeb500157de / tree e885b7675b940c00e820f0022091fe2af585ad4e: no security finding.

The only delta from accepted head bd8d147b82a7f5de8bb3c6c5df7f986f65f5dc35 is the 13-line conversion of the existing custom-browser, alias, and default-browser controls into three explicit node:test declarations. The real-helper body, child-process capture, URL/argument checks, shell: true refusal, dependency lock, runtime patch, and policy bytes are unchanged. The focused final-head receipt reports 3 tests passing with 0 failures or skips. The prior head also completed the full Documentation Qualification job successfully.

Conditional source acceptance carries forward to this exact head. Final-head normal CI and exact Pages deployment acceptance remain required; #411 stays open until those receipts are complete. The separate unchanged dependency-audit intake is #413 and does not expand or block this PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud