chore(deps): pin dompurify, js-yaml, postcss-selector-parser in starlight-docs

[kylehounslow]

What

Pins three vulnerable transitive dependencies in the docs/starlight-docs lockfile via package.json overrides. All three bumps stay within their existing majors.

Package	From	To	Advisory	Severity	Pulled in by
dompurify	3.4.5	3.4.12	CVE-2026-49978 (+8 more)	9.3 CRITICAL	mermaid
js-yaml	4.1.1	4.3.0	CVE-2026-59869, CVE-2026-53550	7.5 HIGH	@astrojs/starlight
postcss-selector-parser	6.1.2	6.1.4	CVE-2026-9358	4.3 MEDIUM	postcss-nested

Source alert: #357 (starlight-docs section). Tracking alerts: #258 (mermaid: dompurify, 9 CVEs, highest 9.3) and #278 (starlight: js-yaml + postcss-selector-parser, highest 7.5).

Why overrides

dompurify and js-yaml resolve one lockfile refresh away from their patched versions, but postcss-selector-parser is a transitive dep of postcss-nested (^6.1.1); npm install --package-lock-only alone keeps it pinned at 6.1.2. An explicit overrides entry is required to move it. Per the CVE-2026-9358 advisory the fix was backported to the 6.x line in 6.1.3, so ^6.1.3 (resolving to 6.1.4) clears it without a major bump. The other two are placed in the same overrides block so the intended floor is auditable in the manifest, not only in the lockfile.

The astro-7 / starlight-0.41 supersets (#336, #356) are intentionally excluded; the astro v7 evaluation is tracked separately (#340, #327).

Validation

Mirrors docs-ci.yml, Node 22:

• npm ci && npm run build (starlight): green, 135 pages, all internal links valid.
• Mermaid render check: 63 built pages carry <pre class="mermaid">, and the bundled dist/_astro/mermaid.core.*.js ships DOMPurify 3.4.12. dompurify is mermaid's XSS sanitizer, so this confirms the patched sanitizer reaches the built output, not just the lockfile.
• npm audit --omit=dev: dompurify, js-yaml, and postcss-selector-parser all clear. Remaining audit entries (astro, esbuild, postcss, sharp, svgo, vite) are out of scope for this alert.
• npm ls dompurify js-yaml postcss-selector-parser: all three report overridden at the patched versions.

Closes #258, closes #278

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.62%. Comparing base (782b129) to head (39422be).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #361   +/-   ##
=======================================
  Coverage   55.62%   55.62%           
=======================================
  Files           4        4           
  Lines         169      169           
  Branches       47       48    +1     
=======================================
  Hits           94       94           
  Misses         74       74           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.