Update deps

.github/workflows/ci.yml

@@ -403,7 +403,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
           cache-dependency-path: docs/package-lock.json
 

cmd/mpe/subcommands/lint/core.go

@@ -418,7 +418,7 @@ func runOpaCheckOnFiles(files []string, fileToEntityMap map[string]string, tmpDi
 	// Add the files to check
 	args = append(args, files...)
 
-	cmd := exec.Command("opa", args...)
+	cmd := exec.Command("opa", args...) // #nosec G702 -- args are built from operator-supplied CLI flags/env vars, not untrusted input; exec.Command does not invoke a shell
 	output, err := cmd.CombinedOutput()
 
 	if err != nil {

cmd/mpe/subcommands/lint/core_test.go

@@ -316,6 +316,10 @@ func TestPerformRegalLinting_ValidFiles(t *testing.T) {
 
 // TestPerformRegalLinting_InvalidRego tests performRegalLinting with bad Rego
 func TestPerformRegalLinting_InvalidRego(t *testing.T) {
+	if isFIPSMode() {
+		t.Skip("Regal linting not available in FIPS 140-only mode")
+	}
+
 	ctx := context.Background()
 
 	badRegoFile := createTempFileFromTestData(t, "bad-rego.yml")

cmd/mpe/subcommands/lint/regal.go

@@ -7,6 +7,7 @@ package lint
 import (
 	"context"
 	"fmt"
+	"os"
 	"strings"
 
 	"github.com/open-policy-agent/regal/pkg/linter"
@@ -16,6 +17,17 @@ import (
 	"github.com/manetu/policyengine/pkg/policydomain/parsers"
 )
 
+// isFIPSMode reports whether the process is running in FIPS 140-only mode.
+// Regal uses OPA's crypto.md5 builtin internally, which panics in this mode.
+func isFIPSMode() bool {
+	for _, kv := range strings.Split(os.Getenv("GODEBUG"), ",") {
+		if kv == "fips140=only" {
+			return true
+		}
+	}
+	return false
+}
+
 // performRegalLinting runs Regal lint on all embedded Rego code extracted from the given files.
 // It uses the Regal Go library directly instead of shelling out to the regal CLI.
 // Returns the number of violations found.
@@ -65,6 +77,11 @@ func performRegalLinting(ctx context.Context, files []string) int {
 		return 0
 	}
 
+	if isFIPSMode() {
+		fmt.Println("⚠ Regal linting skipped: not supported in FIPS 140-only mode (uses crypto/md5 internally)")
+		return 0
+	}
+
 	return runRegalLint(ctx, regoFiles, fileToEntityMap)
 }
 

docs/docusaurus.config.ts

@@ -9,6 +9,9 @@ const config: Config = {
 
   future: {
     v4: true,
+    faster: {
+      swcHtmlMinimizer: false,
+    },
   },
 
   headTags: [
@@ -76,6 +79,9 @@ const config: Config = {
 
   markdown: {
     mermaid: true,
+    mdx1Compat: {
+      headingIds: true,
+    },
     hooks: {
       onBrokenMarkdownLinks: ({sourceFilePath, url}) => {
         throw new Error(`Broken markdown link in ${sourceFilePath}: ${url}`);