chore: resolve open dependabot security alerts

[jonathannorris]

Summary

Resolved 7 of 8 open Dependabot security alerts by bumping vulnerable transitive dependencies. Four were fixed by a lockfile-only re-resolution (their parents' ranges already permit the patched versions); three required scoped Yarn resolutions.

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#229	form-data	high	Bumped to 4.0.6 via lockfile re-resolution
#240	http-proxy-middleware	medium	Bumped to 3.0.7 via scoped resolution (webpack-dev-server/http-proxy-middleware)
#237	markdown-it	medium	Bumped to 14.2.0 via scoped resolution (markdownlint/markdown-it)
#228	tar	medium	Bumped to 7.5.16 via lockfile re-resolution
#227	launch-editor	medium	Bumped to 2.14.1 via lockfile re-resolution
#226	js-yaml	medium	Bumped 4.x consumers to 4.2.0 via scoped resolution js-yaml@^4.1.0
#225	@babel/core	low	Bumped to 7.29.7 via lockfile re-resolution

Notes

• The js-yaml resolution is intentionally scoped to the ^4.1.0 range (not global). gray-matter@4.0.3 depends on js-yaml@^3.13.1 and calls the safeLoad API that was removed in js-yaml 4; a global bump would break Docusaurus frontmatter parsing at build time. The scoped resolution keeps gray-matter on js-yaml 3.14.2 while patching the 4.x consumers.
• The existing webpack: 5.104.1 pin is retained so webpackbar's ProgressPlugin keeps working.
• http-proxy-middleware is dev-server-only (not in the production build). The only patched line is 3.x; yarn docusaurus start was verified to boot cleanly with 3.0.7.

Unresolvable

• [DOC] update OFO tutorial with Helm and new spec changes #80 tsup (low): no patched version is available yet (first_patched_version is null), so this alert is left open.

Verification

• yarn build (full Docusaurus production build): succeeds, both Server and Client compiled.
• yarn lint:md (markdownlint-cli2, the js-yaml/markdown-it consumer): 0 errors.
• yarn install --immutable: passes (lockfile consistent).
• yarn docusaurus start: dev server boots with http-proxy-middleware 3.0.7.
• Pre-existing yarn typecheck errors (missing image type declarations and a C++ dataset entry) are unrelated to these changes and reproduce on a clean origin/main.

[netlify]

✅ Deploy Preview for openfeature ready!

Name	Link
🔨 Latest commit	d5c2f3c
🔍 Latest deploy log	https://app.netlify.com/projects/openfeature/deploys/6a5e2d41a9c75000088885b2
😎 Deploy Preview	https://deploy-preview-1402--openfeature.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 109c3b69-7bad-4ed4-ace7-c5e3482a1ab4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The resolutions section in package.json is updated to pin additional transitive dependency versions: js-yaml@^4.1.0, markdownlint-cli2/js-yaml, markdownlint/markdown-it, and webpack-dev-server/http-proxy-middleware are added or updated, replacing the previous markdownlint-cli2/js-yaml entry (>=4.1.1).

Changes

Dependency Resolution Pins

Layer / File(s)	Summary
Transitive dependency resolution pins package.json	Adds js-yaml, markdownlint/markdown-it, and webpack-dev-server/http-proxy-middleware to the resolutions block and replaces the prior markdownlint-cli2/js-yaml version constraint.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: resolving open Dependabot security alerts.
Description check	✅ Passed	The description is directly related to the dependency security alert fixes in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR addresses Dependabot security alerts in the site’s Yarn (v4) dependency graph by re-resolving the lockfile and adding targeted resolutions overrides to bump vulnerable transitive packages while avoiding known-breaking upgrades (notably keeping gray-matter on js-yaml v3).

Changes:

• Updated yarn.lock to pull patched transitive versions (e.g., form-data@4.0.6, tar@7.5.16, launch-editor@2.14.1, @babel/core@7.29.7, markdown-it@14.2.0, http-proxy-middleware@3.0.7, js-yaml@4.2.0).
• Added/adjusted scoped Yarn resolutions entries to force specific dependency subtrees onto patched versions while avoiding incompatible majors (e.g., js-yaml v4 only for v4 consumers).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
yarn.lock	Re-resolves dependency tree to patched versions, including major transitive bumps where required (e.g., http-proxy-middleware to v3).
package.json	Adds scoped resolutions to force patched transitive versions (including js-yaml, markdown-it, http-proxy-middleware).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jonathannorris]

Superseded by #1422 — main has moved substantially since this branch was opened (many of these packages were already bumped by other merged security PRs), and this branch now has merge conflicts. Closing in favor of a fresh branch off current main that addresses the full current set of 22 open alerts.