[glen-84]

Summary

• Re-resolves the vulnerable transitive npm packages in website/yarn.lock — dompurify, js-yaml 3.x and 4.x, mermaid, undici, tar, brace-expansion 1.x and 5.x, and @babel/core — to versions outside every open advisory's range, clearing all 37 open Dependabot alerts.
• Lock-file only (yarn up -R): every fixed version fits its parent's declared range, so package.json is unchanged and the direct js-yaml@^5.3.0 stays as-is.
• mermaid moves 11.15.0 → 11.17.0 and brings its own dependency updates (cytoscape, dayjs, katex, @mermaid-js/parser, fastdom); the rest are patch-level.

Test plan

• yarn lint passes.
• yarn build (next build plus the llms generation and validation) passes; the 19 docs pages with mermaid fences render through rehype-mermaid at build time.
• Loaded /docs/fusion/composition in the dev server and confirmed the composition flowchart renders with mermaid 11.17.0.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.