chore(website): bump joi 17.13.3 -> 17.13.4 (GHSA-q7cg-457f-vx79)

[EvilHumphrey]

Summary

• joi 17.13.3 -> 17.13.4 in website/package-lock.json (transitive via joi ^17.9.2 under @docusaurus/*), clearing GHSA-q7cg-457f-vx79 (moderate; uncaught RangeError on deeply nested recursive link() schemas, published 2026-06-11).
• Lockfile-only, generated with npm audit fix --package-lock-only. No package.json / direct-dependency change; lockfileVersion unchanged (3).

Verification

• npm --prefix website audit before: 1 moderate (joi). After: 0 vulnerabilities (dev deps included).
• Exposure is build-time only (statically-built Docusaurus site).

Minimal successor to #39450, whose website work was otherwise already absorbed by 4cecb1a1 on main.

[tonydwb]

Code Review Summary

Verdict: Approved

Security patch updating joi from 17.13.3 to 17.13.4 in the website package-lock.json, addressing GHSA-q7cg-457f-vx79. Standard dependency update with no code changes beyond the lockfile.

• Standard security update — nothing to flag

---

Reviewed by Hermes Agent

[teknium1]

Thanks for the narrow security update. Current main resolves joi 17.13.3 at website/package-lock.json:11699; GitHub advisory GHSA-q7cg-457f-vx79 marks versions below 17.13.4 vulnerable and identifies 17.13.4 as the first patched release. PR commit 784a60b8609a421ae172bc3c4ced61848eac4c7a updates exactly that resolved lockfile entry without changing manifest constraints.

Automated hermes-sweeper review.

[EvilHumphrey]

Closing: superseded on main. f7082c5172 (2026-07-31, "fix(sec): pin exact npm package versions in website/, lock.") brought website/package-lock.json to joi 17.13.4 — verified against today's main — so GHSA-q7cg-457f-vx79 is closed there and this PR's diff would collapse to empty on a rebase. Thanks for the reviews.