fix(docs): lint Markdown without markdownlint-cli2 to drop vulnerable braces

.github/workflows/docs.yml

@@ -12,7 +12,6 @@ on:
       - ".github/CODEOWNERS"
       - ".github/workflows/docs.yml"
       - ".lycheeignore"
-      - ".markdownlint-cli2.jsonc"
       - "package.json"
       - "bun.lock"
       - "bunfig.toml"
@@ -25,7 +24,6 @@ on:
       - ".github/CODEOWNERS"
       - ".github/workflows/docs.yml"
       - ".lycheeignore"
-      - ".markdownlint-cli2.jsonc"
       - "package.json"
       - "bun.lock"
       - "bunfig.toml"

.github/workflows/security.yml

@@ -35,10 +35,9 @@ jobs:
       # all npm transitives) are covered; JSR-aliased entries are extracted and queried but only
       # match if OSV ever learns the alias.
       #
-      # osv-scanner.toml holds expiring, per-advisory ignores for advisories with no fixed
-      # release; patched versions are pinned through "overrides" in the root package.json.
+      # Patched versions of vulnerable transitive dependencies are pinned through "overrides" in
+      # the root package.json.
       scan-args: |-
-        --config=osv-scanner.toml
         --lockfile=bun.lock
         --lockfile=packages/hyperliquid/.dev/ts7/bun.lock
       # Keep SARIF upload disabled; results are available as a build artifact and

apps/docs/package.json

@@ -8,7 +8,7 @@
     "build": "fumadocs-mdx && next build && bun run scripts/export-markdown.ts && bun run scripts/verify-export.ts",
     "check": "bun run check:content && fumadocs-mdx && next typegen && tsc --noEmit",
     "test": "bun test lib/",
-    "check:content": "bun run scripts/check-content.ts && markdownlint-cli2 --config ../../.markdownlint-cli2.jsonc ../../README.md ../../packages/hyperliquid/README.md README.md \"content/**/*.md\""
+    "check:content": "bun run scripts/check-content.ts && bun run scripts/lint-markdown.ts"
   },
   "dependencies": {
     "@bloxwap/font": "0.1.2",
@@ -33,6 +33,6 @@
     "postcss": "8.5.28",
     "tailwindcss": "4.3.3",
     "typescript": "5.9.3",
-    "markdownlint-cli2": "0.23.3"
+    "markdownlint": "0.41.1"
   }
 }

apps/docs/scripts/lint-markdown.ts

@@ -0,0 +1,65 @@
+/**
+ * Lints the repository's Markdown: the root, SDK, and documentation-app READMEs plus every documentation page.
+ *
+ * Runs the markdownlint rule engine directly rather than through markdownlint-cli2. The CLI's file discovery
+ * (globby → fast-glob → micromatch → braces) pulled in braces ≤ 3.0.3 (GHSA-vfj7-8cjw-p6xm, no patched release),
+ * which failed the dependency scan; `Bun.Glob` finds the same files without that chain. Rules, configuration,
+ * output format, and exit status match the CLI.
+ *
+ * @module
+ */
+
+import { dirname, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import type { Configuration, LintError } from "markdownlint";
+import { lint } from "markdownlint/promise";
+
+const APP_DIR: string = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const ROOT_DIR: string = resolve(APP_DIR, "../..");
+
+/** Rule overrides; every other markdownlint rule keeps its default. */
+const config: Configuration = {
+  // This repository wraps prose at 120 columns, while the markdownlint default is 80.
+  MD013: false,
+  // Fumadocs frontmatter supplies navigation titles; Markdown keeps its visible H1.
+  MD025: { front_matter_title: "" },
+  // Separate GitHub alert blocks use blank quoted lines by design.
+  MD028: false,
+  // The root README starts with centered HTML branding, and embedded HTML is intentional there.
+  MD033: false,
+  MD041: false,
+};
+
+// Same set the CLI linted: three READMEs plus `content/**/*.md`. Bun.Glob skips dot-paths by default, as globby did.
+const files: string[] = [
+  join(ROOT_DIR, "README.md"),
+  join(ROOT_DIR, "packages/hyperliquid/README.md"),
+  join(APP_DIR, "README.md"),
+  ...[...new Bun.Glob("content/**/*.md").scanSync({ cwd: APP_DIR, absolute: true })].sort(),
+];
+
+// Keyed by repository-relative path so the report names files the way a reader finds them.
+const strings: Record<string, string> = {};
+for (const file of files) strings[relative(ROOT_DIR, file)] = await Bun.file(file).text();
+
+const results = await lint({ strings, config });
+let failures = 0;
+for (const [name, errors] of Object.entries(results).sort(([a], [b]) => a.localeCompare(b))) {
+  for (const error of errors.toSorted((a: LintError, b: LintError) => a.lineNumber - b.lineNumber)) {
+    // Mirrors markdownlint-cli2's default formatter: `file:line[:column] severity rule description [detail] [context]`.
+    const column = error.errorRange?.[0] ? `:${error.errorRange[0]}` : "";
+    const detail = error.errorDetail ? ` [${error.errorDetail}]` : "";
+    const context = error.errorContext ? ` [Context: "${error.errorContext}"]` : "";
+    console.error(
+      `${name}:${error.lineNumber}${column} ${error.severity} ${error.ruleNames.join("/")} ${error.ruleDescription}${detail}${context}`,
+    );
+    // Like the CLI, only error-severity results fail the check.
+    if (error.severity === "error") failures++;
+  }
+}
+
+if (failures > 0) {
+  console.error(`markdownlint: ${failures} error(s) in ${files.length} files`);
+  process.exit(1);
+}
+console.log(`markdownlint: ${files.length} files, no errors`);