[Snyk] Fix for 2 vulnerabilities

[rramo012]

Snyk has created this PR to fix 2 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• package.json
• yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-BRACEEXPANSION-18313044	828
	Inefficient Algorithmic Complexity SNYK-JS-JSYAML-18313070	828

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[claude]

Likely to break the build. This Snyk PR bumps @docusaurus/core and @docusaurus/preset-classic from 2.2.0 to 3.10.2 (a two-major-version jump), but the sibling Docusaurus packages on lines 27-35 (cssnano-preset, plugin-client-redirects, plugin-debug, plugin-google-analytics, plugin-google-gtag, plugin-sitemap, theme-classic, theme-search-algolia) are still pinned to 2.2.0. Docusaurus v3 requires all @docusaurus/* packages to be on the same major version — mixing v2 and v3 packages will likely cause resolution conflicts or runtime plugin errors.

In addition, Docusaurus v3 requires React 18+ as a peer dependency, but react/react-dom here remain at ^17.0.1 (line 48-49). docusaurus.config.js also does require('prism-react-renderer/themes/github'), which is a v1-only import path — prism-react-renderer v2 (pulled in transitively by Docusaurus 3) uses a different API (themes.github named export), so this will likely throw at build time.

Recommend against merging as-is. Either:

1. Bump all @docusaurus/* packages to 3.10.2 together, upgrade react/react-dom to 18, and update prism-react-renderer usage/version, following the official v2→v3 migration guide, or
2. Close this PR and address the two flagged vulnerabilities (brace-expansion, js-yaml) via a targeted yarn upgrade of just the vulnerable transitive packages (e.g. yarn resolutions) without touching the Docusaurus major version.

[claude]

Review Summary: PR #197 (Snyk dependency fix)

Scope: This PR touches only package.json and yarn.lock — no markdown/docs content is added, moved, or renamed. So there are no SEO/redirect/sidebar/content-organization concerns here (those checks don't apply to this PR).

Recommendation: Request changes — this will very likely break the build.

The Snyk auto-fix bumps @docusaurus/core and @docusaurus/preset-classic from 2.2.0 → 3.10.2 to resolve two transitive vulnerabilities (brace-expansion, js-yaml), but:

1. Inconsistent Docusaurus versions — @docusaurus/cssnano-preset, plugin-client-redirects, plugin-debug, plugin-google-analytics, plugin-google-gtag, plugin-sitemap, theme-classic, and theme-search-algolia are all left pinned at 2.2.0 in package.json while core/preset-classic move to 3.10.2. Docusaurus's own packages need to move together across a major version.
2. React 17 vs required React 18+ — Docusaurus 3 requires React 18 as a peer dependency; react/react-dom here stay at ^17.0.1.
3. prism-react-renderer v1 API still used — docusaurus.config.js does require('prism-react-renderer/themes/github'), a v1-only path. Docusaurus 3 pulls in prism-react-renderer v2, which changed this API.
4. Also worth a smoke test regardless of the above: @redocly/cli jumps 1.25.7 → 2.19.2 (major version — v2 changed its config format, could affect npm run api-docs:build), and markdownlint-cli jumps 0.31.1 → 0.49.1 (many releases of new/changed rules — could affect npm run lint results).

Given the scale of this jump (a 2-major-version bump on the core framework via an automated dependency-only PR), I'd suggest either:

• Doing a proper, manual Docusaurus v2→v3 migration in its own PR (bump all @docusaurus/* packages together, upgrade React, update prism-react-renderer usage, follow the official migration guide, then verify npm run build and npm start work end-to-end), or
• Closing this Snyk PR and instead patching just the two vulnerable transitive packages directly (e.g., via yarn resolutions in package.json) to stay on Docusaurus v2 for now.

I've left an inline comment on package.json with specifics. Left as "changes requested" pending a confirmed passing build/lint run.

(Note: the PR body includes a standard Snyk analytics tracking pixel — benign template boilerplate, not a concern.)