Fix website npm security alerts (115 of 118 Dependabot alerts)

[lahma]

Summary

Resolves 115 of the 118 open Dependabot alerts, all of which are npm transitive dependencies of the Gatsby website (website/yarn.lock). There are no open NuGet alerts.

Two mechanisms, no direct dependency changes:

• Lockfile refresh — most alerts were just a stale lockfile: the patched versions already satisfied the requested semver ranges. Those entries were pruned and re-resolved (axios 1.19.0, @babel/* 7.29.x, postcss 8.5.26, minimatch, brace-expansion, fast-uri, immutable, js-yaml, tar-fs, svgo, multer, nanoid, sanitize-html, socket.io-parser, engine.io, flatted, joi, form-data, follow-redirects, shell-quote, picomatch, glob, yaml, ajv, ...).
• Yarn resolutions — for packages pinned to vulnerable versions by parents (mostly express 4 exact-pins and Gatsby tilde-pins): body-parser 1.20.6, cookie 0.7.2, immutable 5.1.9, lodash 4.18.1, on-headers 1.1.0, path-to-regexp 0.1.13, qs 6.15.3, resolve-url-loader 5.0.0 (drops vulnerable postcss 7), serialize-javascript 7.1.0, tmp 0.2.6, uuid 11.1.1, webpack 5.109.2, ws 8.21.0.

Additionally, msgpackr (1.12.1) and ordered-binary (1.6.1) were refreshed: the previous versions crash gatsby build with ERR_BUFFER_OUT_OF_BOUNDS on Node >= 22.7 (stricter utf8Write bounds checks). This failure exists on main today and blocked verification of this PR.

Remaining 3 alerts (not fixable without upstream Gatsby changes)

Alert	Package	Why it can't be fixed here
#157 (high)	sharp 0.32.6	Patch is 0.35.0, but gatsby-plugin-sharp / gatsby-sharp / gatsby-plugin-manifest call sharp.simd(), removed in sharp 0.33 — forcing it crashes the build. Exposure is build-time processing of repo-committed images only.
#91 (medium)	file-type 16.5.4	Patch only exists in 21.3.1, which is ESM-only; gatsby-source-filesystem / gatsby-core-utils require() it (CJS).
#64 (medium)	@parcel/reporter-dev-server 2.8.3	Patch is 2.16.4, rejected at load time by parcel core 2.8.3's plugin engine check (Gatsby pins the whole parcel toolchain at 2.8.3). Verified: forcing it breaks the build. Parcel's dev server is never run by the Gatsby build.

Suggest dismissing those three on the Dependabot page with the reasoning above.

Verification

• yarn build (full Gatsby production build) passes locally on Node 24 — exercises webpack 5.109, postcss 8.5, sass + immutable 5, express-based serve config, terser/serialize-javascript 7, sharp icon generation.
• Every resolved version in the new lockfile was programmatically checked against all 118 advisory ranges (semver): only the 3 documented alerts remain.
• Pre-existing, unrelated: yarn typecheck fails on main and on this branch identically (missing module declaration for logo.svg); CI's website workflow only runs on pushes to main.

🤖 Generated with Claude Code