fix: override vulnerable dompurify release

[smiggleworth]

Summary

• override the vulnerable transitive dompurify pin from monaco-editor
• refresh the lockfile to dompurify 3.4.12

Verification

• npm run check
• npm ls dompurify --all

[Copilot]

Pull request overview

This pull request aims to mitigate a vulnerable transitive dompurify dependency (pulled in via the Monaco toolchain) by pinning dompurify@3.4.12 using npm overrides, alongside a broader dependency refresh that regenerates multiple documentation snapshots and updates docs/marketing content to reflect upstream @askrjs/* changes.

Changes:

• Add an npm overrides pin to force dompurify@3.4.12, and refresh package-lock.json accordingly.
• Upgrade a set of @askrjs/* dependencies and regenerate versioned docs artifacts (API snapshot/manifest, CLI snapshot, package versions).
• Update documentation content to match the newer router/registry contract and remove the “maturity” section content from docs/marketing pages.

Reviewed changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/docs-catalog.test.ts	Updates docs-catalog assertions after removing maturity content export.
src/pages/marketing/home.tsx	Removes marketing “maturity statement” section from the homepage.
src/pages/docs/usage-guide.ts	Updates docs examples to reflect newer router/registry API shapes.
src/pages/docs/release-notes.ts	Removes exported maturityStatement and keeps release notes list.
src/pages/docs/page.tsx	Removes maturity section from docs landing page rendering.
src/pages/docs/package-versions.ts	Regenerates installed @askrjs/* version map.
src/pages/docs/content-overrides.ts	Updates multiple doc strings to reference explicit RouteRegistry contract.
src/pages/docs/cli-snapshot.ts	Regenerates CLI snapshot version.
src/pages/docs/catalog.ts	Removes “Maturity” heading from docs landing TOC.
src/pages/docs/api-snapshot.ts	Regenerates API symbol snapshot reflecting updated exports/signatures.
src/pages/docs/api-manifest.ts	Regenerates API manifest with updated package versions and symbol sets.
scripts/generate-api-snapshot.ts	Adjusts snapshot generation to filter removed router symbols and rename option type in signatures.
package.json	Bumps @askrjs/* versions and adds overrides: { dompurify: 3.4.12 }.
package-lock.json	Lockfile refresh reflecting dependency upgrades and dompurify@3.4.12.

Comments suppressed due to low confidence (2)

src/pages/docs/content-overrides.ts:2026

• This section still documents getRouteWarnings(options?) as if the options parameter were optional, but the API snapshot in this PR changes the signature to require options: MatchRouteOptions. The docs should match the new contract to avoid confusion/type errors.

      "`matchRoute(path, options)` runs a path through the router's matching logic without booting an app, returning a `RouteMatch` or `null`; pass the same explicit `RouteRegistry` used by your application via `MatchRouteOptions` to test against a specific route set. It's the fastest way to assert that a given URL resolves to the route you expect, including param extraction, before wiring up any actual navigation.",
    warnings:
      "`getRouteWarnings(options?)` surfaces route-collision problems as `RoutePatternWarning[]` — each warning reports the `kind` (currently `'route-collision'`), the conflicting `path`, the specific `segment` that collides, and an optional `namespace` for MFE-style route grouping. Run it in a test against the same explicit `RouteRegistry` your app uses to catch ambiguous patterns before they show up as a mis-routed request in production.",

src/pages/docs/content-overrides.ts:2034

• The troubleshooting guidance mentions getRouteWarnings() with no arguments, but in this PR the API snapshot updates getRouteWarnings to require MatchRouteOptions. Consider updating the prose to show passing { registry } (and similarly include options for matchRoute) so the snippet remains accurate.

    'routing-and-ssg':
      "A route that 404s unexpectedly, or two routes silently shadowing each other, is best diagnosed with @askrjs/askr/testing's `matchRoute()` and `getRouteWarnings()` against the same explicit `RouteRegistry` your app uses — the latter flags `route-collision` warnings with the conflicting path and segment directly. For SSG output missing a page, check that the route's `entries` generator (used to enumerate static params) is actually returning the param combination you expect.",

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.