[mcclowes]

Resolves the Dependabot alerts the security-update job keeps failing on: tinypool (critical), postcss-selector-parser, serialize-javascript, uuid and qs.

• Scoped overrides where Docusaurus 3.10 or a build tool pins a vulnerable transitive version; in-range npm audit fix for the rest.
• braces has no patched release; that alert stays open.

Verified locally: npm run build passes and the lockfile passes npm ci. typecheck (TS 6 baseUrl deprecation) and lint fail identically on main; there is no PR CI. sprintf-js also has no patched release.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated versions of several underlying packages used by the project’s build and supporting tools. These updates do not add or remove any documented product features. The minimum supported Node.js version remains unchanged at 20.0 or later.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docusaurus-plugins-docs	Ready	Preview	Oct 15, 2026 10:27pm UTC

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7de19a20-4b83-405e-8460-97d1b1f92bf9

📥 Commits

Reviewing files that changed from the base of the PR and between 81f347f and 94f737b.

⛔ Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing: 1

• package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The package manifest adds dependency overrides for webpack and selected nested dependencies. The Node.js minimum remains >=20.0.

Changes: Dependency overrides

Layer / File(s)	Summary
Package-manager overrides package.json	Adds overrides for webpack, Docusaurus-related nested dependencies, and postcss-selector-parser.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 94f73

This change updates transitive dependency overrides to address security alerts. No actionable merge-blocking risk was found, and the lockfile resolves qs to a patched version.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly summarizes the main change: updating transitive dependencies to address open security advisories.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}