chore: consolidate dependabot /docs dependency bumps

[Copilot]

Numerous open Dependabot PRs each bumped a single npm dependency in /docs. This consolidates all of them into one change to docs/package.json and docs/yarn.lock, replacing PRs #1248–1268 and #1199–1201.

Direct dependency bumps (docs/package.json)

• js-yaml: 4.1.1 → ^4.3.1 (resolves to 4.3.2 in yarn.lock)
• path-to-regexp: 1.8.0 → 8.3.0 (major)
• react / react-dom: 19.2.0 → ^19.2.1 (resolves to 19.2.8 in yarn.lock, bumped together — Docusaurus requires matching versions)
• react-router: 6.28.1 → ^7.18.2 (major, resolves to 7.18.3 in yarn.lock)
• react-router-dom: 7.18.2 → 7.18.3

All of the above use the same ^ caret-range convention as the rest of docs/package.json's dependencies, so yarn.lock resolves each to the latest compatible patch/minor release rather than the exact literal version listed in the individual Dependabot PRs. This is consistent with how Dependabot's own PRs work (they also bump to a caret range, and the lockfile can drift further on subsequent yarn install). The versions above reflect what's actually pinned in yarn.lock in this PR.

Transitive dependency bumps (docs/yarn.lock)
lodash, webpack-dev-server, http-proxy-middleware, postcss, websocket-driver, nanoid, joi, shell-quote, fast-uri, launch-editor, picomatch, @babel/plugin-transform-modules-systemjs, svgo, follow-redirects — all bumped to or above requested target versions.

Notable deviations

• webpack is capped at 5.105.4 instead of the requested 5.110.2. Webpack 5.106.0+ introduced stricter ProgressPlugin schema validation that is incompatible with Docusaurus's webpackbar integration, breaking yarn build with a ValidationError. This is corroborated by the real Dependabot PR chore: bump webpack from 5.103.0 to 5.110.2 in /docs #1255, whose CI check ("Generate docs website to GitHub Pages") fails for the same reason. 5.105.4 is the latest patch before the regression. This cap is enforced via Yarn's resolutions field (alongside trim, got, js-yaml, on-headers) rather than as a plain dependencies/devDependencies entry, so every transitive consumer of webpack in /docs resolves to this single pinned version instead of potentially picking up a different one.
• node-forge (PR chore: bump node-forge from 1.3.2 to 1.4.0 in /docs #1260) is no longer a dependency at all — webpack-dev-server 5.2.6 dropped it, so that bump is moot.
• brace-expansion was already at 1.1.18 from PR chore: bump brace-expansion from 1.1.12 to 1.1.18 in /docs #1246 (merged) — no change needed.

Major version bumps, no code changes required
react-router and path-to-regexp are not imported directly anywhere in /docs source (only pulled in as indirect/pinned dependencies), so their major-version jumps needed no source adjustments.

yarn build in /docs has been verified to complete successfully with this package.json/yarn.lock.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

[sozercan]

lgtm