Pin the patched brace-expansion and uuid in the docs site

[andredlng]

Summary

The docs site had 8 open Dependabot alerts and npm audit reported 23 vulnerabilities. It now reports 0.

Two overrides entries, alongside the serialize-javascript one already there:

"overrides": {
  "serialize-javascript": "^7.0.3",
  "brace-expansion": "5.0.8",
  "uuid": "11.1.1"
}

Why npm audit fix was no help

It changed nothing at all — no lockfile edit, no diff. Its proposed fix for the high-severity brace-expansion advisory was @easyops-cn/docusaurus-search-local@0.26.1, while package.json pins ^0.55.2: a downgrade across majors of the search plugin, which is worse than the issue it addresses. That is why it was marked breaking and skipped.

The advisory itself is unusually broad — it flags <= 5.0.7, so every 1.x and 2.x release qualifies, and the only patched release is 5.0.8. Overriding the transitive dependency keeps the plugin at 0.55 and resolves it.

Half the alerts were already stale

Dependabot listed js-yaml and http-proxy-middleware, but the lockfile already carried exactly the patched versions:

package	installed	advisory wants
js-yaml	3.15.0, 4.3.0	3.15.0, 4.3.0
http-proxy-middleware	2.0.10	2.0.10
brace-expansion	1.1.16, 2.1.3	5.0.8
uuid	8.3.2	11.1.1

Only the last two needed anything.

Verified

• npm audit → found 0 vulnerabilities
• npm run build succeeds; index, imports and reference pages all generated
• the search plugin still emits build/search-index.json, which is the thing npm's suggested downgrade would have put at risk

Scope

Docs site only. None of these packages ship with the Python CLI — they are build-time dependencies of the Docusaurus site, and all four advisories are DoS-class.

[github-actions]

📖 Docs preview

Preview site: https://brave-water-0cee36e03-1444.westeurope.7.azurestaticapps.net

No rendered doc pages changed.