lexicalunit · lexicalunit · Jun 24, 2026 · Jun 24, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -19,6 +19,25 @@ updates:
         patterns:
           - "*"
 
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 14
+    labels:
+      - "dependencies"
+      - "frontend"
+    commit-message:
+      prefix: "deps"
+      prefix-development: "deps-dev"
+      include: "scope"
+    groups:
+      security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -44,6 +44,9 @@ jobs:
               - 'uv.lock'
             docs:
               - 'docs/**'
+              - 'package.json'
+              - 'package-lock.json'
+              - 'scripts/vendor-docs-assets.mjs'
             frontend:
               - 'src/spellbot/web/templates/**'
               - 'tests-js/**'
@@ -205,6 +208,15 @@ jobs:
       - name: Checkout Source
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
+      - name: Setup Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "24"
+          cache: "npm"
+
+      - name: Vendor docs assets
+        run: npm ci && npm run docs:vendor
+
       - name: Setup Ruby
         uses: ruby/setup-ruby@89f90524b88a01fe6e0b732220432cc6142926af # v1
         with:

diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
@@ -7,6 +7,9 @@ on:
     paths:
       - "docs/**"
       - ".github/workflows/pages.yml"
+      - "package.json"
+      - "package-lock.json"
+      - "scripts/vendor-docs-assets.mjs"
   workflow_dispatch:
 
 env:
@@ -28,6 +31,15 @@ jobs:
       - name: Checkout Source
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
+      - name: Setup Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "24"
+          cache: "npm"
+
+      - name: Vendor docs assets
+        run: npm ci && npm run docs:vendor
+
       - name: Setup Ruby
         uses: ruby/setup-ruby@89f90524b88a01fe6e0b732220432cc6142926af # v1
         with:

diff --git a/.gitignore b/.gitignore
@@ -18,8 +18,10 @@ demo_analytics.html
 docs/_site
 docs/.bundle/config
 docs/.DS_Store
+docs/.jekyll-cache
 docs/.sass-cache
 docs/.vagrant
+docs/assets/vendor
 docs/beautiful-jekyll-theme-*.gem
 docs/ehthumbs.db
 docs/Gemfile.lock

diff --git a/.oxfmtrc.json b/.oxfmtrc.json
@@ -3,7 +3,7 @@
   "printWidth": 100,
   "ignorePatterns": [
     "docs/assets/js/beautifuljekyll.js",
-    "docs/assets/js/jquery-*.js",
-    "docs/assets/js/staticman.js"
+    "docs/assets/js/staticman.js",
+    "docs/assets/vendor/**"
   ]
 }
diff --git a/.oxlintrc.json b/.oxlintrc.json
@@ -2,8 +2,8 @@
   "$schema": "./node_modules/oxlint/configuration_schema.json",
   "ignorePatterns": [
     "docs/assets/js/beautifuljekyll.js",
-    "docs/assets/js/jquery-*.js",
-    "docs/assets/js/staticman.js"
+    "docs/assets/js/staticman.js",
+    "docs/assets/vendor/**"
   ],
   "categories": {
     "correctness": "error"

diff --git a/.prettierignore b/.prettierignore
@@ -1,6 +1,6 @@
 # Vendored / third-party CSS assets — do not format
-docs/assets/css/bootstrap-social.css
 docs/assets/css/beautifuljekyll.css
-docs/assets/css/beautifuljekyll-minimal.css
 docs/assets/css/pygment_highlights.css
-docs/assets/css/staticman.css
+
+# Vendored from npm at build time (scripts/vendor-docs-assets.mjs)
+docs/assets/vendor/
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -10,6 +10,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 ### Added
 
 - More formatting tools.
+- npm Dependabot coverage; vendor the docs site's frontend libraries (jQuery, Bootstrap, popper, Font Awesome) from npm instead of pinned CDN URLs.
+- Trim unused beautiful-jekyll theme features from the docs site: blog posts (post/home layouts, tags, RSS feed, pagination), all comment providers and Staticman, navbar search, MathJax, the minimal layout, and disabled analytics providers (kept gtag). Removed the third-party CDN scripts these pulled in along the way.
 
 ## [v21.3.2](https://github.com/lexicalunit/spellbot/releases/tag/v21.3.2) - 2026-06-19
 

diff --git a/docs/Makefile b/docs/Makefile
@@ -1,12 +1,23 @@
-.PHONY: all run
+.PHONY: all run build
 
 all: run
 
 run:
+	cd .. && npm ci && npm run docs:vendor
 	@command -v rbenv >/dev/null 2>&1 || brew install rbenv
 	rbenv install --skip-existing
 	eval "$$(rbenv init - zsh)" && \
 		rbenv rehash && \
 		(bundle update --bundler 2>/dev/null || true) && \
 		bundle install && \
 		bundle exec jekyll serve
+
+build:
+	cd .. && npm ci && npm run docs:vendor
+	@command -v rbenv >/dev/null 2>&1 || brew install rbenv
+	rbenv install --skip-existing
+	eval "$$(rbenv init - zsh)" && \
+		rbenv rehash && \
+		(bundle update --bundler 2>/dev/null || true) && \
+		bundle install && \
+		bundle exec jekyll build --strict_front_matter
diff --git a/docs/_config.yml b/docs/_config.yml
@@ -250,7 +250,6 @@ timezone: "America/Toronto"
 markdown: kramdown
 highlighter: rouge
 permalink: /:year-:month-:day-:title/
-paginate: 5
 
 kramdown:
   input: GFM
@@ -281,7 +280,6 @@ exclude:
   - docs/
 
 plugins:
-  - jekyll-paginate
   - jekyll-redirect-from
   - jekyll-sitemap
 

diff --git a/docs/_includes/cloudflare_analytics.html b/docs/_includes/cloudflare_analytics.html
diff --git a/docs/_includes/commentbox.html b/docs/_includes/commentbox.html
diff --git a/docs/_includes/comments.html b/docs/_includes/comments.html
diff --git a/docs/_includes/disqus.html b/docs/_includes/disqus.html
diff --git a/docs/_includes/fb-comment.html b/docs/_includes/fb-comment.html
diff --git a/docs/_includes/footer-minimal.html b/docs/_includes/footer-minimal.html
diff --git a/docs/_includes/giscus-comment.html b/docs/_includes/giscus-comment.html
diff --git a/docs/_includes/google_analytics.html b/docs/_includes/google_analytics.html
diff --git a/docs/_includes/gtm_body.html b/docs/_includes/gtm_body.html
diff --git a/docs/_includes/gtm_head.html b/docs/_includes/gtm_head.html
diff --git a/docs/_includes/head.html b/docs/_includes/head.html
@@ -54,15 +54,7 @@
   <meta name="keywords" content="{{ site.keywords }}">
   {% endif %}
 
-  {% if site.rss-description %}
-  <link rel="alternate" type="application/rss+xml" title="{{ site.title }}" href="{{ '/feed.xml' | absolute_url }}">
-  {% endif %}
-
   {% include gtag.html %}
-  {% include gtm_head.html %}
-  {% include google_analytics.html %}
-  {% include cloudflare_analytics.html %}
-  {% include mathjax.html %}
 
   {% if layout.common-ext-css %}
     {% for css in layout.common-ext-css %}
@@ -155,12 +147,6 @@
   <meta name="twitter:image" content="{{ img | absolute_url }}">
   {% endif %}
 
-  {% include matomo.html %}
-
-  {% if page.comments and site.staticman.repository and site.staticman.branch %}
-  <link rel="stylesheet" href="{{ "/assets/css/staticman.css" | relative_url }}">
-  {% endif %}
-
   {% assign favicon_exists = site.static_files | where: "path", "/favicon.ico" | size %}
   {% if favicon_exists == 1 %}
   <link rel="icon" href="{{ '/favicon.ico' | relative_url }}" />

diff --git a/docs/_includes/header.html b/docs/_includes/header.html
@@ -44,9 +44,6 @@ <h2 class="{{ include.type }}-subheading">{{ page.subtitle | strip_html }}</h2>
                 Last updated {{ page.last-updated | date: date_format }}
               </span>
             {% endif %}
-            {% if page.readtime %}
-              {% include readtime.html %}
-            {% endif %}
           {% endif %}
         </div>
       </div>

diff --git a/docs/_includes/mathjax.html b/docs/_includes/mathjax.html
diff --git a/docs/_includes/matomo.html b/docs/_includes/matomo.html