Patch website dependency graph to resolve qs vulnerabilities (pin transitive path to 6.15.2)

[Copilot]

Dependabot could not remediate qs because Docusaurus/Express transitively constrained it to ~6.14.0, which remains vulnerable across the reported advisories. This PR forces the website dependency graph onto a patched qs line (>=6.15.2) without changing Docusaurus package versions.

• Dependency override

  • Added a direct Yarn resolution in website/package.json:
    • "qs": "^6.15.2"
  • This overrides the vulnerable transitive qs@~6.14.0 path pulled via @docusaurus/* -> webpack-dev-server -> express.

• Lockfile update

  • Updated website/yarn.lock so the qs@~6.14.0 entry resolves to 6.15.2 (same tarball/integrity as existing qs@~6.15.1).

• Scope

  • No Docusaurus package upgrades or app/runtime code changes; only website dependency graph/lock resolution.

// website/package.json (resolutions)
{
  "resolutions": {
    "qs": "^6.15.2"
  }
}

[Copilot]

Pull request overview

This PR updates the Docusaurus website’s Yarn dependency graph to remediate known qs vulnerabilities by forcing transitive qs@~6.14.0 consumers to use qs@6.15.2, without upgrading Docusaurus itself.

Changes:

• Add a Yarn resolutions override for qs to require ^6.15.2.
• Update website/yarn.lock so the qs@~6.14.0 selector resolves to 6.15.2.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
website/package.json	Adds qs to Yarn resolutions to override vulnerable transitive constraints.
website/yarn.lock	Updates the qs@~6.14.0 lock entry to resolve to 6.15.2.

[meta-codesync]

@talgalili has imported this pull request. If you are a Meta employee, you can view this in D106237139.

[meta-codesync]

@talgalili merged this pull request in f2135e5.