docs: pin patched versions of the documentation site's vulnerable build dependencies

[sven-n]

Resolves the fixable Dependabot alerts which appeared with the documentation site in #894.

All of them sit in the build toolchain of docs-website. Nothing here is shipped: the published site is static HTML, and the server is not affected. The alert count looks large because three root advisories cascade up through every Docusaurus package.

What changed

An overrides block in docs-website/package.json forces two transitive dependencies to a patched version. That takes the audit from 25 findings (6 moderate, 19 high) to 18, all of which are the cascade of a single advisory pair which has no fix.

Package	Pinned by	Advisory	Fix
serialize-javascript 6.0.2	copy-webpack-plugin and css-minimizer-webpack-plugin pin ^6.0.0	GHSA-5c6j-r48x-rmvq (RCE), GHSA-qj8w-gfj5-8c6v (CPU exhaustion)	^7.1.0
uuid 8.3.2	sockjs, via webpack-dev-server, pins ^8.3.2	GHSA-w5hq-g745-h8pq	^11.1.1

npm audit reports serialize-javascript as "No fix available", which is misleading: 7.1.0 exists and is outside the vulnerable range, npm just cannot reach it through the parents' pins. An override can.

For uuid, only v3/v5/v6 with a buf argument are affected and sockjs calls v4, so it was not exploitable here either way — the override is there to clear the alert.

What is not fixed

image-size, used by @docusaurus/mdx-loader to measure the images of a page, is affected by GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq in every published version — the advisory range is * and the installed 2.0.2 is already the latest. There is no version to move to.

Both are a denial of service through a crafted ICNS, JXL or HEIF file, evaluated at build time over the images committed to this repository. Triggering it means committing a malicious image, and the damage is a hanging build; no published page and no game server is exposed. These 18 findings are reasonable candidates to dismiss as "risk is tolerable" if the open alerts are noisy.

Notes

The reasoning, and the condition for removing each override again (npm ls <package> no longer printing "overridden"), is documented in docs-website/README.md, so the pins don't turn into cargo cult.

Testing

Verified with a clean install from the lockfile, the way CI does it:

cd docs-website
rm -rf node_modules && npm ci
npm ls serialize-javascript uuid   # both report "overridden"
npm audit                          # 18 high, all image-size
npm run build                      # passes

The dev server (npm start) was started as well, since the uuid override lands in sockjs, which is the hot reload path — a build-only check would not have caught a break there. It compiles and serves pages.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LidmXPYjGN64P1RgCiY7Ri

---

Generated by Claude Code