build: add missing workspace dependencies and fix links avatar URL

[hesitling]

Summary

This PR fixes dependency and workspace issues that can break fresh installs/builds, and updates a links avatar URL that was causing image/build problems.

Changes

• add missing root dependencies already used by the site, including markdown/RSS processing, Shiki transformers, and UnoCSS typography support
• add missing packages/pure dependencies required by the bundled astro-pure package at build time
• add pnpm-workspace.yaml so pnpm recognizes packages/pure as a workspace package and allows required native build steps (esbuild, sharp)
• update the public/links.json avatar URL from cravatar.cn to cn.cravatar.com

Why

The codebase already imports these modules from both the app and packages/pure, but they were not fully declared in package.json. That makes installs/builds depend on existing local state instead of the repository manifest. This change makes the dependency graph explicit and reproducible.

This change fixes missing direct dependency declarations.

The app and the local astro-pure package import modules such as @astrojs/markdown-remark, @unocss/preset-typography, rehype-stringify, remark-parse, remark-rehype, unified, shiki, rehype, ultrahtml, and vfile, but those packages were not fully declared in the corresponding package.json files. Builds only worked when those modules happened to be present transitively through other installed packages.

This stayed hidden upstream because the repo is primarily developed with Bun, whose existing hoisted install layout can mask undeclared dependencies. In a stricter pnpm setup, especially once packages/pure is treated as a real workspace package, those phantom dependencies are no longer reliably resolvable, so install/build failures surface.

The avatar URL update avoids failures caused by the previous host/redirect behavior when remote images are processed during build.

Testing

• ran pnpm build
• astro check passed with 0 errors and 0 warnings

[vercel]

@hesitling is attempting to deploy a commit to the cworld Team on Vercel.

A member of the Team first needs to authorize it.

[cworld1]

It is difficult to define whether a package needs an explicit declaration, for example, project also used zod, which is also in Astro package. I truly understand the working ways of pnpm, but I may realize that explicit declarations can be a burden on dependency management. I’ve been busy lately, and when I’m done, I’ll think about whether I need those explicit statements.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
astro-theme-pure	Error		May 25, 2026 9:42am

[0Ky]

update the public/links.json avatar URL from cravatar.cn to cn.cravatar.com

That's not a fix, it's a workaround. The issue still exists, and to resolve it you need to update Astro to version 6.3.0, as that version includes the PR that addresses that issue. Relates to issue #169.