The build moved to mdPress in 1.7.0 ('移除遗留的 vuepress 构建，统一使用
mdpress'), but the VuePress devDependencies stayed. Nothing references them:
build/serve/start/pdf all call mdpress, and the only occurrence of vuepress
in code is '.vuepress' inside check_project_rules.py's ignore list. Pages
still ran 'npm ci', so every deploy installed the whole VuePress tree as
dead weight.
They were also the entire source of the repo's 91 Dependabot alerts. The
lockfile carried two copies of several packages; the vulnerable ones were
all VuePress's (dompurify 2.4.3, highlight.js 9.18.5, katex 0.15.6,
mermaid 9.4.3) while mermaid-cli's copies are above every patched
threshold. Removing the three devDependencies drops 16 of the 20 flagged
packages from the tree entirely and leaves the other four at safe versions.
.vuepress/config.js is deliberately kept — the mirror site it configures is
still live, and whether to archive it is a separate decision.
Verified: npm test passes (3 + 35 tests) and check_project_rules passes
202 files.
dependabot[bot]andGitHub
yeasy
