chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 8 open Dependabot security alerts by bumping transitive dependency resolutions in package.json
• 3 alerts (image-size x2, tsup) have no patched version available upstream yet and are left unresolved

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#287	nanoid	high	Bumped to 3.3.17 via resolution
#285	js-yaml (3.x)	high	Bumped to 3.15.1 via gray-matter/js-yaml resolution
#284	js-yaml (4.x)	high	Bumped to 4.3.1 via markdownlint-cli2/js-yaml, js-yaml@npm:^4.1.0, @redocly/openapi-core/js-yaml, cosmiconfig/js-yaml resolutions
#283	mermaid	medium	Bumped to 11.16.1 via @docusaurus/theme-mermaid/mermaid resolution
#281	mermaid	low	Bumped to 11.16.1 (same fix as above)
#279	mermaid	medium	Bumped to 11.16.1 (same fix as above)
#277	mermaid	medium	Bumped to 11.16.1 (same fix as above)
#275	mermaid	medium	Bumped to 11.16.1 (same fix as above)

Unresolvable (no patched version available)

• [Provider]: LaunchDarkly PHP Server #289 image-size <= 2.0.2 (high) — ICNS parser DoS
• feat: update k8s example #288 image-size <= 2.0.2 (high) — JXL/HEIF parser DoS
• [DOC] update OFO tutorial with Helm and new spec changes #80 tsup <= 8.3.4 (low) — DOM Clobbering

Test plan

• yarn install regenerates lockfile with patched versions for all fixed packages
• yarn build succeeds
• yarn typecheck produces only pre-existing, unrelated errors (verified identical on unmodified main)
• yarn run lint:md passes

[netlify]

✅ Deploy Preview for openfeature ready!

Name	Link
🔨 Latest commit	27a7c1b
🔍 Latest deploy log	https://app.netlify.com/projects/openfeature/deploys/6a7a1a281505b80008f71bbc
😎 Deploy Preview	https://deploy-preview-1437--openfeature.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bfc9274b-95b2-4099-8726-051a1389e970

📥 Commits

Reviewing files that changed from the base of the PR and between 10dfbe5 and 27a7c1b.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

The PR updates Yarn resolution overrides in package.json. It changes js-yaml and Mermaid versions and adds resolutions for Redocly, Cosmiconfig, and nanoid.

Changes

Dependency resolution updates

Layer / File(s)	Summary
Yarn resolution overrides package.json	Existing js-yaml and Mermaid resolutions were updated. Redocly, Cosmiconfig, and nanoid resolutions were added.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• open-feature/openfeature.dev#1422: Both PRs modify Yarn resolutions for js-yaml and related transitive dependencies.

Suggested reviewers: aepfli

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the dependency security resolution work described in the changeset.
Description check	✅ Passed	The description accurately explains the resolved and unresolved Dependabot alerts, dependency updates, and validation results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}