fix: address website dependency vulnerabilities

[FrankChen021]

Dependency

Depends on #19788 and must be merged after #19788.

This is a stacked PR based on #19788 head commit 65630f6ab7100e1e82f160054d90dd502a2d1b7b. Its website dependency changes assume the Docusaurus and Node.js updates from that PR.

Changes

• Refresh compatible transitive website dependencies to their patched releases.
• Add targeted npm overrides for transitive constraints that otherwise retain vulnerable versions:
  • brace-expansion 5.0.8
  • serialize-javascript 7.0.5
  • sockjs's uuid 11.1.1
  • tmp 0.2.7
• Regenerate website/package-lock.json with the repository-pinned npm 10.8.2.

This covers all 50 currently open Dependabot alerts for website/package-lock.json, spanning 27 packages. A range-by-range check against the GitHub alert metadata found zero installed versions within any reported vulnerable range.

The change only affects the documentation website dependency graph. It does not change Druid runtime or web-console dependencies.

Validation

• npx --yes npm@10.8.2 ci
• npm ls --all --omit=optional
• npm run build
• npm run link-lint
• npm run spellcheck (264 files)
• Explicit verification of all 50 alert ranges against every matching package occurrence in the lockfile

The production build succeeds with the existing broken-anchor warnings.

Attribution

This pull request was created by GPT-5.6-Sol.

[FrankChen021]

The failing CostBasedAutoScalerIntegrationTest.test_autoScaler_scalesUpAndDown_withSlowPublish appears unrelated to this PR. The test creates a Kafka topic, immediately publishes 10,000 records, and then times out waiting for the scale-up metric. PR #19824 addresses the likely initial topic-leader readiness race; PR #19817 also hardens non-transactional publishing by waiting for every send result. These are the likely flaky-test fixes, although this autoscaler test does not yet have dedicated regression evidence on either PR.

[Copilot]

Pull request overview

Updates the documentation website’s npm dependency graph to remediate Dependabot-reported vulnerabilities by pinning select transitive packages via npm overrides and regenerating website/package-lock.json accordingly. This aligns the committed lockfile with a patched set of transitive versions without affecting Druid runtime or the web-console.

Changes:

• Add npm overrides in website/package.json to force patched transitive versions (brace-expansion, serialize-javascript, sockjs→uuid, tmp).
• Refresh website/package-lock.json to the updated resolved dependency graph.
• Update website CI install step to use npm ci in .github/scripts/web-checks.sh.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
website/package.json	Adds targeted npm overrides to pin vulnerable transitive packages to patched versions.
website/package-lock.json	Regenerates the lockfile to reflect the overridden/patched transitive dependency graph.
.github/scripts/web-checks.sh	Switches website install step to npm ci for reproducible CI installs.

Files not reviewed (1)

• website/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• website/package-lock.json: Generated file

Comments suppressed due to low confidence (1)

.github/scripts/web-checks.sh:30

• npx --yes npm@10.8.2 ci installs the lockfile with the pinned npm version, but the subsequent npm run ... commands will use whatever npm is on PATH (currently web-console's frontend-maven-plugin installs npm 10.9.0). For reproducibility and to keep the website build checks aligned with the lockfile generator, run the build/link-lint/spellcheck steps via the same pinned npm as well.

(cd website && npx --yes npm@10.8.2 ci)
cd website
npm run build
npm run link-lint
npm run spellcheck