[RGood]

Summary

Fixes the remaining fixable Dependabot alerts in devvit-docs (M12) in one PR. Unlike the earlier lockfile refreshes, this one contains major-version changes and resolutions overrides, because the packages involved are pinned by parents that cannot move. Please review it with that in mind.

Alerts	Package	Fix	Type
#158 (medium)	glob	Direct dependency 10.5.0 → 14.0.2 (same version as Dependabot #277)	Major bump
#42 (high), #72 (medium), #147 (low)	serialize-javascript	Force 6.0.2 → 7.1.4 with two resolutions entries	Override (major)
#159 (medium)	minimatch	Force the remaining 9.0.9 copy to ^11.0.1 (resolves to 11.0.6) with one resolutions entry	Override (major)

Why overrides are needed

• serialize-javascript is only used by copy-webpack-plugin@11 (^6.0.0) and [email protected] (^6.0.1), both pinned by Docusaurus. The newest versions of those plugins use 7.x but Docusaurus 3.10.2 (the latest stable) does not take them. (terser-webpack-plugin 5.6.1 has dropped the dependency, but ours was not the consumer.)
• minimatch: the only affected copy left after glob moves to 14 (which brings minimatch 11) is 9.0.9, used by typedoc 0.28.0. typedoc's newest release uses minimatch 10.x, which is also in the vulnerable range (>=7.0.0, <11.0.1), so only 11.x fixes it. typedoc has no references outside package.json.
• Yarn's 24-hour minimum package age (npmMinimalAgeGate) blocked the newest glob (14.0.5) and minimatch releases, so I used glob 14.0.2 and a ^11.0.1 range for minimatch.

Not included

• deepmerge Add PRAW to Devvit web AI migration guide #156 (low): advisory has no patched version (@svgr/plugin-svgo -> deepmerge ^4.3.1). Cannot be fixed by an upgrade; handled by dismissal.

Verification (local, repo's pinned Yarn 4.18.0)

• yarn install --immutable passes. Lockfile now has glob 14.0.2, minimatch 3.1.5 / 5.1.9 / 11.0.6 (the first two are below the affected range), serialize-javascript 7.1.4. No affected copies remain.
• Full yarn build succeeds with the same warnings as main (5 HTML minifier diagnostics, 2 broken anchors) and the same 11,610 output files.
• Built output compared with a build of current main:
  • CSS bundle byte-identical (exercises css-minimizer with serialize-javascript 7).
  • All 3,785 HTML pages identical after normalizing content hashes.
  • llms.txt identical; llms-full.txt has the same lines and size with the section order differing (order also varies between two builds of main). Both are generated by the plugins that use glob.
  • Only other difference: the runtime~main bundle (same size, minifier variable names).

Risk / rollback

Moderate: major bumps of a direct dependency and of two build-time transitive packages. If the build or deploy misbehaves, revert this single commit. After merge, confirm the Pages deploy succeeds and that #42, #72, #147, #158 and #159 close.

Dependabot #277 (glob 10.5.0 → 14.0.2) becomes redundant.

Part of M12 (fix dependency alerts).

[ben-harris-5]

Thanks I hate it 🐟