Refresh compatible build dependency security fixes

[ktsaou]

Refresh compatible build dependency fixes through Learn's existing version ranges and patch resolutions. The Express/body-parser chain now permits qs 6.16.0, Terser 5.6.1 removes its serialize-javascript dependency, and YAML, Joi, SVGO, selector-parser and Undici use supported updates. Existing resolution-authority assertions name the new patches.

Validation: frozen Yarn install, all 2,032-page publication gates, 490 existing Vitest checks plus one existing skip, and 99 Node checks pass. The rendered redirect file initially ran before its build prerequisite completed; only that file was rerun after publication and passed all 27 checks. A separate direct Terser/Webpack probe minifies a bundle without changing its executable result; production uses SWC/Rspack.

The audit is not clean: 87 advisory/path rows cover ten package names and fourteen GHSAs. Separate Swagger PR #3129 covers the remaining YAML and brace paths. Other findings require unsupported parent changes or have no verified published fix. No forced overrides, direct dependencies, runtime or policy changes are introduced here. This Yarn update does not rewrite prebuilt Swagger assets.

---

Summary by cubic

Refreshes build dependencies through existing Yarn resolutions and version ranges to their security-fixed releases. The Express/body-parser chain now permits qs 6.16.0, Terser 5.6.1 removes its serialize-javascript dependency, and js-yaml, joi, svgo, postcss-selector-parser, and undici move to supported patches. The dependency authority test now asserts the new patch versions.

Validation

• Frozen Yarn install, all 2,032-page publication gates, 490 Vitest checks, and 99 Node checks pass.
• A Terser/Webpack probe minifies a bundle without changing its executable result; production uses SWC/Rspack.

Remaining findings

• The audit is not clean: 87 advisory/path rows remain across ten packages; the rest require unsupported parent changes or have no verified published fix.
• No forced overrides, direct dependencies, or runtime/policy changes are introduced; a separate Swagger PR covers the remaining YAML and brace paths.

^{Written for commit 955a516. Summary will update on new commits.}

[netlify]

✅ Deploy Preview for netdata-docusaurus ready!

Name	Link
🔨 Latest commit	955a516
🔍 Latest deploy log	https://app.netlify.com/projects/netdata-docusaurus/deploys/6ac83264a35c2c0008823feb
😎 Deploy Preview	https://deploy-preview-3130--netdata-docusaurus.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 43 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: e04187a4-114b-4255-b007-6e6e8e2717fe

📥 Commits

Reviewing files that changed from the base of the PR and between 3e846ee and 955a516.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (2)

• package.json
• tests/dependency_authority.test.js

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Architecture diagram

sequenceDiagram
    participant Dev as Developer
    participant CI as CI Pipeline
    participant Yarn as Yarn 1.22.22
    participant Resolver as Yarn Resolver
    participant NPM as npm Registry
    participant Lockfile as yarn.lock
    participant Test as Dependency Authority Test
    participant Docusaurus as Docusaurus Build
    participant Audit as npm Audit

    Note over Dev,Audit: Build Dependency Resolution Flow

    Dev->>Yarn: yarn install --frozen-lockfile
    Yarn->>Resolver: Resolve dependencies
    Resolver->>package.json: Read resolutions map
    package.json-->>Resolver: Version overrides (js-yaml, joi, svgo, qs)

    Note over Resolver,NPM: Resolution Authority Chain
    Resolver->>NPM: Fetch package versions honoring resolutions
    NPM-->>Resolver: Resolved packages (qs 6.16.0, terser 5.6.1, etc.)
    Resolver->>Lockfile: Update lockfile entries
    Lockfile-->>Yarn: Locked dependency tree

    Yarn-->>Dev: Install complete

    Note over Test,Docusaurus: Validation Flow
    Test->>package.json: Read expected resolutions
    package.json-->>Test: Resolution map
    Test->>Lockfile: Verify resolved versions match
    Lockfile-->>Test: Version confirmation
    alt All resolutions match
        Test-->>CI: Pass (490 Vitest + 99 Node checks)
    else Mismatch detected
        Test-->>CI: Fail - resolution authority violation
    end

    CI->>Docusaurus: Build documentation site
    Docusaurus->>Lockfile: Use locked dependency tree
    Lockfile-->>Docusaurus: Dependencies (js-yaml 4.3.2, joi 17.13.8, svgo 3.3.5)
    Docusaurus-->>CI: Publication gates (2,032 pages)

    CI->>Audit: Run security audit
    Audit->>NPM: Query advisory database
    NPM-->>Audit: 87 advisory/path rows (10 packages, 14 GHSAs)
    Audit-->>CI: Non-clean audit status

    Note over CI,Audit: Remaining findings require unsupported parent changes<br/>or have no verified published fix. Separate PR #3129<br/>covers remaining YAML and brace paths.

Loading

_{View guided diff | Turn on auto-fix | Re-trigger cubic}