chore(deps): pin dompurify, js-yaml, postcss-selector-parser in starlight-docs

[kylehounslow]

What

Pins three vulnerable transitive dependencies in the docs/starlight-docs lockfile via package.json overrides. All three bumps stay within their existing majors.

Package	From	To	Advisory	Severity	Pulled in by
dompurify	3.4.5	3.4.12	CVE-2026-49978 (+8 more)	9.3 CRITICAL	mermaid
js-yaml	4.1.1	4.3.0	CVE-2026-59869, CVE-2026-53550	7.5 HIGH	@astrojs/starlight
postcss-selector-parser	6.1.2	6.1.4	CVE-2026-9358	4.3 MEDIUM	postcss-nested

Source alert: #357 (starlight-docs section). Tracking alerts: #258 (mermaid: dompurify, 9 CVEs, highest 9.3) and #278 (starlight: js-yaml + postcss-selector-parser, highest 7.5).

Why overrides

dompurify and js-yaml resolve one lockfile refresh away from their patched versions, but postcss-selector-parser is a transitive dep of postcss-nested (^6.1.1); npm install --package-lock-only alone keeps it pinned at 6.1.2. An explicit overrides entry is required to move it. Per the CVE-2026-9358 advisory the fix was backported to the 6.x line in 6.1.3, so ^6.1.3 (resolving to 6.1.4) clears it without a major bump. The other two are placed in the same overrides block so the intended floor is auditable in the manifest, not only in the lockfile.

The astro-7 / starlight-0.41 supersets (#336, #356) are intentionally excluded; the astro v7 evaluation is tracked separately (#340, #327).

Validation

Mirrors docs-ci.yml, Node 22:

• npm ci && npm run build (starlight): green, 135 pages, all internal links valid.
• Mermaid render check: 63 built pages carry <pre class="mermaid">, and the bundled dist/_astro/mermaid.core.*.js ships DOMPurify 3.4.12. dompurify is mermaid's XSS sanitizer, so this confirms the patched sanitizer reaches the built output, not just the lockfile.
• npm audit --omit=dev: dompurify, js-yaml, and postcss-selector-parser all clear. Remaining audit entries (astro, esbuild, postcss, sharp, svgo, vite) are out of scope for this alert.
• npm ls dompurify js-yaml postcss-selector-parser: all three report overridden at the patched versions.

Closes #258, closes #278

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.62%. Comparing base (782b129) to head (65f2f23).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #361   +/-   ##
=======================================
  Coverage   55.62%   55.62%           
=======================================
  Files           4        4           
  Lines         169      169           
  Branches       47       47           
=======================================
  Hits           94       94           
  Misses         74       74           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[joshuali925]

Suggested change

	"dompurify": "3.4.12",
	"js-yaml": "4.3.0",
	"dompurify": "^3.4.12",
	"js-yaml": "^4.3.0",

no need to lock to the patch version?

I also still don't understand why lockfile is needed, they are all within the same major version. You can try running

npm audit fix

if there is a dependency that's not flagged for cve in npm audit, you can update to latest patch using npm update xxx

it's generally better to avoid package.json changes unless necessary to keep things clean

[kylehounslow]

@joshuali925 Good call. Removed overrides!