fix(deps): bump qs, fast-uri, nanoid and js-yaml to resolve Dependabot alerts

[mpbarnwell]

Summary

Resolves 5 of the 7 open Dependabot alerts by updating transitive dependencies in package-lock.json. Three are lockfile-only bumps within existing semver ranges; qs needs a new overrides entry in package.json because express@4.22.2 / body-parser@1.20.6 pin ~6.15.1 and no 4.x express release picks up 6.16.0 yet.

Package	From	To	Alerts fixed
qs (via @docusaurus/core → webpack-dev-server → express/body-parser)	6.15.2	6.16.0	#134 GHSA-x5fp-wj9c-mxmx (moderate): array-limit bypass via bracket-key comma parsing
fast-uri (via webpack-dev-server → schema-utils → ajv)	3.1.5	3.1.7	#133 GHSA-fph4-wmhf-6fwf (high): SSRF via repeated hostname percent-decoding #132 GHSA-5jgf-p345-68v8 (high): host confusion via skipped IDN canonicalization
nanoid (via @docusaurus/bundler → postcss)	3.3.16	3.3.18	#131 GHSA-2v37-7h3g-55p8 (high): custom generators loop indefinitely when size is zero
js-yaml (via @docusaurus/utils, plugin-content-docs, cosmiconfig, gray-matter)	4.3.0	4.3.2	#129 GHSA-5p4m-2wfm-xmqj (high): quadratic CPU consumption in !!omap resolution

Release notes review

No breaking changes in any of the upgrades:

• qs 6.16.0 (changelog) — minor release. Adds a stringify depth option and several parse/stringify fixes. The relevant fix enforces arrayLimit on comma groups under []= when throwOnLimitExceeded is set. The only behaviour change is stricter limit enforcement on malformed query strings; qs is only reached here through the dev server (webpack-dev-server → express), never in the production static build. 6.15.3 (also included) hardens merge/assign against __proto__ and makes compact O(n).
• fast-uri 3.1.6 (release) and 3.1.7 (release) — pure security-patch releases. 3.1.6 fixes the two alerts above plus GHSA-f65p-4m7j-42xc and GHSA-jqff-g426-hqxp; 3.1.7 (released 2026-09-02) additionally fixes GHSA-qw65-cvwx-89v3 (authority injection via unvalidated port) and GHSA-58mr-gqgx-xq4g (host confusion via IP-literal brackets), which Dependabot has not yet raised against this repo. Going straight to 3.1.7 pre-empts those.
• nanoid 3.3.17 (release) fixes the zero-size infinite loop; 3.3.18 (release) fixes the same loop in the async path on React Native. No API changes.
• js-yaml 4.3.1 (commit) backports the !!omap quadratic-complexity fix from 5.x; 4.3.2 (commit) backports the 5.4.1 merge-sequence limits (hard limit of 100, empty mappings counted toward maxTotalMergeKeys). Only affects pathological YAML; our frontmatter and config are unaffected.

Not fixed: image-size (#127, #128)

GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq (ICNS / JXL / HEIF infinite loops) affect image-size <= 2.0.2 and no patched version exists: 2.0.2 (April 2025) is still latest, the upstream fix PR has been deleted, and the repo has had no code commits since. It is pulled in by @docusaurus/mdx-loader, which uses it at build time only to read the dimensions of local images referenced from MDX, so the input is repo-controlled rather than attacker-controlled. Docusaurus is tracking a replacement in facebook/docusaurus#12231 (open PR #12388); neither latest nor canary has shipped it yet. Recommend dismissing those two alerts as "vulnerable code is not actually used / no fix available" and revisiting when Docusaurus releases the fix.

Verification

• npm run build (Docusaurus production build) passes
• npm run typecheck passes
• npm start dev server boots and serves /docs/ with HTTP 200 (exercises the express → qs path affected by the override)
• npm audit no longer reports qs, fast-uri, nanoid or js-yaml; remaining findings are the image-size alerts above plus a browserslist advisory that Dependabot has not raised
• Lockfile diff touches only the four packages listed

🤖 Generated with Claude Code