site/** pull requests get no build validation: ci-site.yml declares a pull_request trigger but gates its only build job to master and tags, so a bad site lockfile first fails on the post-merge run that deploys. frontend pnpm override floors still admit js-yaml 3.15.0 and 5.2.0, leaving three open advisories including the one PR 2141 closed for site/.