Fix npm transitive dependency security vulnerabilities

[Juminstock]

Summary

Resolves ~50 open Dependabot security alerts by forcing patched versions of vulnerable transitive dependencies via yarn resolutions. All changes were validated with a successful production build.

Changes

• Updated node-forge to ^1.4.0 (signature forgery, DoS — 4 HIGH alerts)
• Updated tar to ^7.5.11 (path traversal, symlink poisoning — 6 HIGH alerts)
• Updated mermaid to ^11.15.0 (CSS/HTML injection, XSS, DoS — 6 alerts)
• Updated dompurify to ^3.4.0 (multiple XSS and prototype pollution bypasses — 9 alerts)
• Updated minimatch to ^3.1.4 / ^9.0.7 (ReDoS — 6 HIGH alerts)
• Updated serialize-javascript to ^7.0.5 (RCE, CPU exhaustion — 2 alerts)
• Updated lodash and lodash-es to ^4.18.1 (code injection, prototype pollution — 6 alerts)
• Updated fast-uri to ^3.1.2 (path traversal, host confusion — 2 HIGH alerts)
• Updated picomatch to ^2.3.2 / ^4.0.4 (ReDoS, method injection — 4 alerts)
• Updated @babel/plugin-transform-modules-systemjs to ^7.29.4 (arbitrary code execution — 1 HIGH alert)
• Updated svgo to ^3.3.3 (Billion Laughs DoS — 1 HIGH alert)
• Updated path-to-regexp 0.1.12 to 0.1.13 (ReDoS — 1 HIGH alert)
• Updated ws@^8 to ^8.20.1 (uninitialized memory disclosure — 1 alert)
• Updated qs to ^6.15.2 (multiple DoS vectors — 3 alerts)
• Updated ip-address to ^10.1.1 (XSS in HTML-emitting methods — 1 alert)
• Updated ajv to ^6.14.0 / ^8.18.0, brace-expansion, follow-redirects, js-yaml, mdast-util-to-hast, on-headers, uuid@^11 (misc medium/low alerts)
• Pinned webpack to 5.99.9 to prevent ProgressPlugin schema breakage on Docusaurus 3.8.1
• Updated lycheeverse/lychee-action from v1.7.0 to v2.0.2 in broken-links.yml

Known remaining alerts

Package	Reason
webpack-dev-server (#56, #57, #132)	Fix lives in v5; Docusaurus 3.8.1 uses v4 internally. Resolves with the Docusaurus 3.10.x upgrade.
webpack (#79, #80)	LOW severity. 5.100+ breaks Docusaurus 3.8.1 ProgressPlugin schema. Same Docusaurus upgrade path.
uuid@^8 (#133 partial)	No patch exists in the v8 branch; fix is only in v11. Not exploitable in this build context.

[github-actions]

Visit the preview URL for this PR (updated for commit 8986383):

https://astar-docs--pr792-feat-update-node-pac-ckns8nnw.web.app

_{(expires Fri, 12 Jun 2026 14:52:59 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: f2f13e9b593d211faae6343d67a88fac3fd7268d}

[ipapandinas]

Why not bumping some dependencies rather than using resolutions?

[Juminstock]

Why not bumping some dependencies rather than using resolutions?

Thanks for the review and feedback, Igor!

I opted to use resolutions because I wanted to address the vulnerability alerts specifically, but you make a good point.

I'll keep that in mind and implement it that way in the future.