Sweep Dependabot alerts: clear 51 of 52 open advisories

[DavidFBD]

Clears 51 of the 52 open Dependabot alerts on this repo.

The nanoid security email that prompted this was already stale: it reported CVE-2026-73086 (< 3.3.12), but two stricter nanoid advisories had landed since — CVE-2026-67214 (< 3.3.16) and CVE-2026-67213 (< 3.3.18). Patching to the version the email asked for would have left two highs open, so the override goes straight to ^3.3.18.

What changed

Change	Alerts cleared
next 15.5.18 → 15.5.21	16 (8 CVEs, 4 high)
dompurify → 3.4.14	11
js-yaml → 3.15.2 / 4.3.2	6
nanoid → 3.3.18	3
mermaid → 10.9.8	3
brace-expansion → 2.1.4	3
sharp → 0.35.4	2
postcss → 8.5.28	2
broken-link-checker removed	2 (request, uuid@3.4.0)
fflate, postcss-selector-parser, uuid added as overrides	3

Notes on two non-obvious bits

sharp needed an override, not just a version bump. Bumping the direct dependency to ^0.35.0 did not clear the advisory, because next@15.5.21 pins sharp@0.34.5 as its own optional dependency. Only adding a sharp override displaces it. Confirmed running libvips 8.18.6, above the 8.18.3 that GHSA-f88m-g3jw-g9cj requires.

Overrides intentionally stay in package.json. With lockfileVersion: 9.0 and no packageManager field, Vercel builds with pnpm 9, which reads pnpm.overrides from package.json. Note that pnpm 11 no longer reads that field — it warns and continues — so local installs must use npx --yes pnpm@9 install until the lockfile is migrated deliberately. A plain pnpm install on pnpm 11 would silently drop every security pin. Resolution here was done with pnpm 9 so the lockfile stays at v9.0 and local matches production exactly.

Removing broken-link-checker

It had no patched release path and was the sole source of request@2.88.2 (unpatchable) and uuid@3.4.0. Safe to drop because its only consumer, scripts/test.js, was dead code — every event handler and the enqueue() call were commented out, and no npm script referenced it. That file is deleted here.

Link checking is unaffected: scripts/link-check.mjs uses linkinator, and both CI workflows (broken-link-check.yml, linkinator.yml) invoke GitHub Actions rather than this dependency.

Still open after this PR

next-mdx-remote@4.4.1 — high severity, arbitrary code execution in React SSR of untrusted MDX. Deferred deliberately, not missed:

• Patched only in 6.0.0, a major that nextra@2.13.4 does not support; forcing it is expected to break the build.
• All MDX in this repo is first-party and committed, so the untrusted-input path the advisory describes is not reachable.

Resolving it properly means a Nextra 2 → 3 migration, which deserves its own scoping rather than riding along in a security sweep.

Verification

• pnpm@9 install clean, lockfile reported up to date — so Vercel's frozen-lockfile install will pass
• next build completes across all pages
• sharp loads its native binary and encodes correctly (libvips 8.18.6)
• All 51 cleared alerts confirmed by semver-matching each advisory's vulnerable range against installed versions, rather than assuming the bumps took

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs-icon-community	Ready	Preview	Sep 6, 2026 6:47am UTC