chore(deps): consolidate open Dependabot updates (Aug 2026)

[fgalz]

Summary

• Bump direct deps: js-yaml 5.2.3, mermaid 11.16.1, openai 6.49.0, react/react-dom 19.2.8, webpack 5.109.2, baseline-browser-mapping 2.11.13
• Pin transitive security patches via overrides: webpack-dev-server 5.2.6, shell-quote 1.10.0, websocket-driver 0.7.5, brace-expansion@1 1.1.18, fast-uri 3.1.5, dompurify 3.4.13
• Supersedes Dependabot PRs Bump brace-expansion from 1.1.15 to 1.1.18 #1842, Bump dompurify from 3.4.11 to 3.4.13 #1841, Bump mermaid from 11.16.0 to 11.16.1 #1840, Bump fast-uri from 3.1.2 to 3.1.5 #1839, Bump openai from 6.45.0 to 7.2.0 #1838, Bump react-dom from 19.2.7 to 19.2.8 #1837, Bump baseline-browser-mapping from 2.10.43 to 2.11.8 #1836, Bump react from 19.2.7 to 19.2.8 #1835, Bump webpack from 5.108.4 to 5.109.2 #1834 and consolidate PR chore(deps): consolidate open Dependabot updates (Jul 2026) #1833
• Skips openai 7.x (requires Node >=22; engines still >=18.0)

Test plan

• npm run build -- --locale en succeeds locally
• CI build passes for remaining locales
• Docusaurus dev server starts without errors