Fix 20 open Dependabot alerts via transitive dependency overrides (angefragt von Florian Galz)

[askmarvin1337]

Summary

Closes 20 of the 22 currently open Dependabot alerts by pinning vulnerable transitive dependencies to their patched versions via npm overrides, scoped to the specific parent chain wherever a package resolves to multiple divergent versions in the tree:

Package	From	To	Alert(s)
nanoid	3.3.16	3.3.18	#162
js-yaml (5 internal docusaurus consumers only — root stays on ^5.2.1)	4.2.0 / 4.3.0	4.3.1	#161, #143
postcss	8.5.19	8.5.26	#160
brace-expansion (1.x line)	1.1.15	1.1.18	#158, #154, #145
brace-expansion (2.x line, filelist only)	2.1.1	2.1.4	#159, #157, #146
dompurify	3.4.11	3.4.13	#153, #136
fast-uri	3.1.2	3.1.5	#147, #138, #137
body-parser (webpack-dev-server's nested express@4.x only — root express@5.x keeps ^2.3.0)	1.20.5	1.20.6	#144
webpack-dev-server	5.2.5	5.2.6	#141, #140
shell-quote	1.8.4	1.10.0	#139
uuid (sockjs only — root uuid@14.x untouched)	8.3.2	11.1.1	#115

Not fixed: image-size (#156, #155) has no patched release yet upstream — latest published version is still 2.0.2, same as the vulnerable one. A fix PR exists upstream (image-size/image-size#439) but hasn't shipped as an npm release. Flagging for awareness; nothing actionable on our side until upstream releases a patch.

Test plan

• npm install resolves every targeted package to its patched version at the correct place in the tree (verified via npm ls <pkg> for all 10 packages)
• npm audit drops from 31 to 20 findings, all remaining ones attributable solely to image-size (no fix available)
• npm run build completes successfully
• npm run start dev server boots and serves HTTP 200 (exercises the webpack-dev-server/express/sockjs/body-parser chain directly)
• git diff limited to the exact changed lockfile entries, no unrelated lockfile churn

🤖 Generated with Claude Code