fix(deps): resolve Dependabot security alerts

[mpbarnwell]

Resolves 10 of the 11 open Dependabot alerts by bumping transitive dependencies to patched versions.

This is a lockfile-only change — package.json is untouched, no direct dependency versions or overrides were changed.

Fixed

Package	From	To	Severity	Advisory
body-parser	1.20.5	1.20.6	low	GHSA-v422-hmwv-36x6
brace-expansion	1.1.15	1.1.16	high	GHSA-3jxr-9vmj-r5cp
fast-uri	3.1.2	3.1.4	high	GHSA-4c8g-83qw-93j6, GHSA-v2hh-gcrm-f6hx
js-yaml	4.2.0	4.3.0	high	GHSA-52cp-r559-cp3m
postcss	8.5.15	8.5.23	high	GHSA-r28c-9q8g-f849
shell-quote	1.8.4	1.10.0	high	GHSA-395f-4hp3-45gv
svgo	3.3.3	3.3.4	high	GHSA-2p49-hgcm-8545
webpack-dev-server	5.2.5	5.2.6	medium	GHSA-f5vj-f2hx-8m93, GHSA-m28w-2pqf-7qgj

Not fixed — no compatible patch exists yet

brace-expansion / GHSA-mh99-v99m-4gvg (high) — DoS via unbounded expansion length.

The only patched version is 5.0.8; the advisory declares the entire <= 5.0.7 range vulnerable, so the 1.x, 2.x and 3.x maintenance lines have no backport.

The vulnerable path is @docusaurus/core > serve-handler@6.1.7 > minimatch@3.1.5 > brace-expansion@1.1.16, and neither override works:

• Forcing brace-expansion@5.0.8 breaks minimatch@3.x. v1 exported the function directly (module.exports = expandTop); v5 exports an object { expand, EXPANSION_MAX, EXPANSION_MAX_LENGTH }. Verified in isolation: TypeError: expand is not a function.
• Forcing minimatch@^10.2.6 (the only line depending on brace-expansion@^5) breaks serve-handler, which does require('minimatch')(...) — minimatch v9+ switched to named exports.

@docusaurus/core@3.10.2 is already the latest release and still pins serve-handler@^6.1.7, so there is no upstream path off the vulnerable transitive tree today. Worth revisiting once Docusaurus bumps serve-handler, or brace-expansion backports to 1.x.

Risk in the meantime is low: serve-handler only runs under docusaurus serve (local preview of the built site) and never in the deployed static build, and the glob patterns it expands come from our own config rather than user input.

Verification

• npm run typecheck — passes
• npm run build — passes, static files generated
• npm run serve — starts and serves correctly (exercises the serve-handler path)

🤖 Generated with Claude Code