fix(deps): prevent vulnerable docs resolution

[yordis]

• The documentation dependency graph contained denial-of-service and path-disclosure advisories, including four high-severity findings.
• Current pnpm releases ignore the previous override location, leaving patched transitive resolution unenforced during future lockfile refreshes.
• VuePress must remain on its supported Vite release line so security updates do not break production documentation builds.

[cursor]

PR Summary

Low Risk
Docs-only dependency and lockfile changes; main risk is a broken vuepress build if override pins disagree with VuePress, mitigated by dropping the Vite override.

Overview
Moves pnpm dependency overrides out of docs/package.json into a new docs/pnpm-workspace.yaml, matching current pnpm behavior so patched transitive versions stay enforced on lockfile updates.

The override set is refreshed for security: pins esbuild@0.25.12, bumps js-yaml (range → 4.3.1), postcss / postcss-selector-parser, and immutable, while keeping existing pins for braces, lodash, micromatch, prismjs, and rollup. @vitejs/plugin-vue and vite overrides are removed so VuePress can keep its supported Vite 8 line without a forced downgrade.

Also adds allowBuilds for esbuild and unrs-resolver, with a regenerated pnpm-lock.yaml reflecting the new override source and resolved graph (including explicit esbuild in the VuePress/Vite toolchain).

^{Reviewed by Cursor Bugbot for commit 2488507. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 09c57af9-a4ee-4791-857f-206fcd71f515

📥 Commits

Reviewing files that changed from the base of the PR and between bff060a and 2488507.

⛔ Files ignored due to path filters (1)

• docs/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• docs/package.json
• docs/pnpm-workspace.yaml

💤 Files with no reviewable changes (1)

• docs/package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The docs package removes local pnpm overrides. A new workspace file centralizes dependency overrides and permits build scripts for esbuild and unrs-resolver.

Changes

Docs pnpm configuration

Layer / File(s)	Summary
Workspace build and dependency policy docs/pnpm-workspace.yaml	The workspace permits builds for esbuild and unrs-resolver. It pins versions for selected dependencies.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 24885

This centralizes docs dependency overrides and narrowly permits required package build scripts, maintaining patched dependency resolution without an identified current merge risk.

Poem

I’m a rabbit with a tidy workspace to tend
Pnpm pins now gather in one neat little bend
Esbuild may build, and resolvers may run
Dependencies line up beneath the sun
Hop, hop—clean config is done

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description directly explains the documented dependency vulnerabilities, the pnpm override relocation, and the need to preserve the supported Vite release line.
Title check	✅ Passed	The title clearly summarizes the main change: preventing vulnerable dependency resolution in the documentation package.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch yordis/fix-dependency-cves

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}