chore(deps): Bun 1.4.2 + serapan ADR-0120 + fast-uri ^3.1.7 — tiga PR tak terpisahkan jadi satu

.changesets/2026-09-05-advisory-fast-uri-naik-ke-3-1-7.md

@@ -0,0 +1,38 @@
+---
+bump: patch
+tipe: dependency
+dampak: internal
+---
+
+# Override `fast-uri` naik ke `^3.1.7`, menutup empat advisory sekaligus
+
+`bun audit --audit-level=low` mulai merah lagi meski override sudah ada:
+`^3.1.5` di `package.json` tetap resolve ke `fast-uri@3.1.5`, dan versi itu
+sendiri yang dinamai empat advisory `high` —
+[GHSA-5jgf-p345-68v8](https://github.com/advisories/GHSA-5jgf-p345-68v8),
+[GHSA-f65p-4m7j-42xc](https://github.com/advisories/GHSA-f65p-4m7j-42xc),
+[GHSA-fph4-wmhf-6fwf](https://github.com/advisories/GHSA-fph4-wmhf-6fwf), dan
+[GHSA-jqff-g426-hqxp](https://github.com/advisories/GHSA-jqff-g426-hqxp) —
+yang rentangnya (`>=3.0.0 <3.1.6`, `>=3.1.2 <3.1.6`, `>=3.1.3 <3.1.6`) semuanya
+masih mencakup `3.1.5`. Rantainya sama seperti override sebelumnya:
+
+```
+@astrojs/check › @astrojs/language-server › volar-service-yaml
+  › yaml-language-server › ajv-i18n › ajv › fast-uri
+```
+
+`ajv` menyatakan `fast-uri: ^3.0.1`, jadi `3.1.7` — rilis patch 3.x terbaru,
+dan pertama yang menutup keempat advisory di atas — masih di dalam rentang
+yang dinyatakan `ajv` sendiri. `overrides` dinaikkan ke **`^3.1.7`, bukan
+`^4.x`**: 4.x melompati mayor pada pustaka parsing URI yang tidak diminta
+`ajv` maupun advisory-nya, dan sebuah override yang memaksakan mayor yang
+tak teruji lintas dependency transitif adalah risiko baru untuk masalah yang
+sudah selesai di 3.x.
+
+Lockfile diregenerasi penuh (`rm -rf node_modules bun.lock && bun install`)
+sesuai aturan repo, bukan disunting sebagian. Regenerasi penuh ikut menaikkan
+beberapa dependency tak terkait ke versi terbaru yang masih di dalam rentang
+`^` masing-masing di `package.json` (a.l. `astro` resolve ke `7.3.1`,
+`@astrojs/node` ke `11.1.5`, `@astrojs/sitemap` ke `3.7.4`) — bukan perubahan
+kontrak, karena rentang `^` di `package.json` sendiri tidak berubah, dan
+`bun run check` + `bun test` tetap hijau sesudahnya.

.claude/skills/awcms-astro-integrasi/SKILL.id.md

@@ -5,7 +5,7 @@ description: Kontrak integrasi awcms-astro ↔ awcms — tenant dari token mesin
 
 🇮🇩 Bahasa Indonesia · 🇬🇧 [English (source)](SKILL.md)
 
-<!-- i18n-source-hash: sha256:e6693862c3ff75de29ec398d073a0f551f0aa7ac55eebbd2b757d398dfdccc7a -->
+<!-- i18n-source-hash: sha256:2a3b1bed54aff44a0a85dcbfab459ddcce1cd2e64164703a85d993950816b6fe -->
 
 # awcms-astro — kontrak integrasi dengan `awcms`
 
@@ -342,7 +342,7 @@ dan sengaja TIDAK diduplikasi di sini: dua salinan data yang digerbangi adalah
 dua salinan yang boleh menyimpang, dan yang menyimpang selalu yang tidak dibaca
 mesin. Yang ada di sini penjelasannya; yang ada di sana buku besarnya.
 
-Ringkasannya: **lantai ADR-0049**, puncaknya ADR-0119, **nol** bervonis `belum`.
+Ringkasannya: **lantai ADR-0049**, puncaknya ADR-0120, **nol** bervonis `belum`.
 Jumlah persisnya sengaja TIDAK ditulis di sini lagi — ia berbunyi "68 ADR" sampai
 2 September 2026 sementara gerbangnya menghitung 70, dan sebuah angka dalam prosa
 yang tidak dibaca pemeriksa mana pun akan hanyut lagi persis seperti itu

.claude/skills/awcms-astro-integrasi/SKILL.md

@@ -404,6 +404,7 @@ predating this consumer, and this repo has **not** examined them systematically
 | 0117 | diperiksa | `:latest` moves only after the release environment's approval signs it. Entirely `awcms`'s own release workflow — this repo builds no container from that pipeline and pulls no `:latest` — so nothing here changes. Recorded because silence and irrelevance read identically |
 | 0118 | diserap | The newsletter endpoints answer a cross-origin browser and resolve that origin's tenant, the four blockers this repo measured are closed, and the three paths are frozen as COMMITTED. Absorbed by [ADR-0049](../../../docs/adr/0049-a-reader-may-subscribe-and-the-first-write-from-a-strangers-browser.md), which turns the caller on |
 | 0119 | diperiksa | The GitHub Release **badge** is decided with an explicit `--latest`, not inherited from `gh`'s date-and-version default — the second "latest" in the same workflow ADR-0117 only half fixed, and it moved backwards to a four-releases-superseded version when parked runs were finally approved. Nothing here changes: `bun run release` creates a **git tag only**. This repo publishes no GitHub Release, no container image, and no `:latest` of any kind, so there is no badge to decide. Recorded because silence and irrelevance read identically — and re-read the moment this repo grows a release workflow, because the defect is invisible in final state: two events that cancel out look exactly like one that never happened |
+| 0120 | diperiksa | The admin redesign splits one status hue into three token families (`-strong`, the new `-on-soft`, plus a new `--color-border-strong`) so `awcms`'s WCAG contrast promise is gated rather than asserted. Every file it touches — `tokens.css`, `admin.css`, `AdminLayout.astro`, `sidebar-menu.ts`, `admin-icons.ts`, `design-token-contrast-check.ts` — is `awcms`'s own admin shell, and this repo carries none of them: admin screens went back to `awcms` in ADR-0020, narrowed only for a USER surface a derived site may declare through `permukaanAdmin` (ADR-0034), and this template ships no such surface. This repo's own token mapping in [`ui-ux-design-system.md`](../../../docs/awcms-astro/ui-ux-design-system.md) already states its "gaps against the AWCMS vocabulary" as a staged, manual adoption path, not a sync — so a values-only redesign over there does not reach a template with no admin implementation to redesign |
 
 <!-- serapan:adr-awcms:selesai -->
 

.github/workflows/ci.yml

@@ -50,7 +50,7 @@ jobs:
       # bergerak bersama (ADR-0015).
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: "1.3.14"
+          bun-version: "1.4.2"
 
       - name: Cache Bun install cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -205,7 +205,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: "1.3.14"
+          bun-version: "1.4.2"
 
       - name: Cache Bun install cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0

Dockerfile

@@ -47,7 +47,7 @@
 #
 # Menaikkan versi Bun berarti menaikkan tag DAN digest bersama. Digest baru:
 #   docker manifest inspect oven/bun:<versi>-alpine   (atau registry API)
-FROM oven/bun:1.3.14-alpine@sha256:5acc90a93e91ff07bf72aa90a7c9f0fa189765aec90b47bdbf2152d2196383c0 AS build
+FROM oven/bun:1.4.2-alpine@sha256:d888c0ae6c86d7866ff10c5aafdd9077b36aee6455b33dd270fb93c0dd5cef6f AS build
 WORKDIR /app
 
 # Lapisan dependency dipisah dari lapisan sumber supaya perubahan konten atau
@@ -135,7 +135,7 @@ RUN bun run audit:konten
 # Permissions-Policy sejak ADR-0019 — dan kompresi ikut pindah ke
 # `server/penyaji.mjs` dan dijaga
 # `tests/penyaji.test.mjs`.
-FROM oven/bun:1.3.14-alpine@sha256:5acc90a93e91ff07bf72aa90a7c9f0fa189765aec90b47bdbf2152d2196383c0 AS runtime
+FROM oven/bun:1.4.2-alpine@sha256:d888c0ae6c86d7866ff10c5aafdd9077b36aee6455b33dd270fb93c0dd5cef6f AS runtime
 WORKDIR /app
 
 ENV NODE_ENV=production \