chore: update dependencies

[dobby-coder]

Security vulnerabilities (fix first)

CVE/GHSA	package	severity	current	fixed in	description
GHSA-r28c-9q8g-f849	postcss	high	8.5.14	8.5.18	Path traversal in previous source-map auto-loading (sourceMappingURL) can disclose arbitrary .map files. Pulled in transitively via vitepress -> vite/@vue/compiler-sfc; build-time only (vitepress build), not shipped to the site's runtime bundle.
GHSA-c2j3-45gr-mqc4	dompurify	low	3.4.11	3.4.12	CUSTOM_ELEMENT_HANDLING bypasses afterSanitizeElements for allowed custom elements. Pulled in via mermaid (a runtime dependencies entry) and ships in the client bundle that renders diagrams in visitors' browsers.

Both are currently held below their patched versions by the overrides block in package.json:

"overrides": {
  "esbuild": "^0.25.0",
  "vite": "^6.4.3",
  "dompurify": ">=3.4.11"
}

dompurify needs its floor raised to >=3.4.12. postcss isn't overridden at all yet and resolves to 8.5.14 transitively; add a postcss override (or a nested override under vitepress) pinned to >=8.5.18.

npm outdated reports no drift beyond this — every direct dependency is already at the newest version satisfying its declared range, so this is a pure security-floor issue, not routine version bumping.

Outdated packages

Clean — npm outdated --json returned no results. No minor/major bumps pending.

Worker instructions

1. Fix the CVEs above in severity order: postcss (high, build-tooling-only impact but trivial to fix) then dompurify (low, but shipped to the runtime/browser bundle via mermaid).
2. Raise the dompurify override floor to >=3.4.12 and add a postcss override pinned to >=8.5.18, then regenerate the lockfile with plain npm install (see CLAUDE.md: never use --legacy-peer-deps here, it drops the optional search-insights peer and breaks the strict npm ci used in CI's Dockerfile).
3. There are no other outdated minor/patch/major bumps pending right now, so no further version evaluation is needed this round.
4. Build and verify: rm -rf node_modules && npm ci && npm run docs:build (matches the Docker build CI runs). This repo has no automated test suite beyond the build itself — note that in the PR description.
5. Confirm npm audit is clean after the change.
6. Open a draft PR closing this issue, watch CI, and run gh pr ready once it's green.

[dobby-coder]

/dobby fix — resolve the dependency updates in this issue; CVEs first in severity order, then minor/patch, then majors; verify each CVE still applies to main; build + test; open a draft PR closing the issue; keep CI green.

[dobby-coder]

On it! I'm going through the dependency updates in this issue now — CVEs first in severity order, then minor/patch bumps, then majors — re-verifying each CVE still applies to main before touching anything. I'll build and test as I go, then open a draft PR that closes this issue once everything's green.

[dobby-coder]

Parked: this is dobby-initiated work coupled to @rubenhensen, who already has 3 dobby PRs waiting for review (budget: 3). I'm not opening another one until some of those merge or close — comment here to re-trigger dobby once there's room.