fix(deps): patch svgo, js-yaml, joi, and colord Dependabot advisories

[Devon-White]

Summary

Resolves 7 of the 9 open Dependabot alerts. All affected packages are transitive dependencies of the Docusaurus build; neither published package under packages/ depends on them directly.

Every patched release is a semver-patch bump already inside the range its dependents declare, so this is a lockfile-only change — no pnpm-workspace.yaml overrides were needed this time.

Alerts	Package	Change
#176, #175	svgo 3.3.4 → 3.3.5	removeScripts bypasses via namespaces, control characters, and foreignObject.
#181, #180	js-yaml 3.15.1 → 3.15.2, 4.3.1 → 4.3.2	maxTotalMergeKeys does not limit CPU use for empty merge sources. Dev-scope only.
#179, #177	joi 17.13.4 → 17.13.7	Prototype pollution via __proto__ in custom messages; object().rename() template targets. Dev-scope only.
#178	colord 2.9.3 → 2.10.0	Slow rejection of oversized malformed color strings.

colord resolved to 2.10.0 rather than the 2.9.4 minimum. That's a minor bump, but it is within the ^2.9.x its dependents ask for, so a fresh install lands there regardless.

Still not fixed: image-size (#168, #167)

Unchanged from #43 — no patched release exists yet. 2.0.2 is still the latest on npm and the advisories cover every version through it; @docusaurus/mdx-loader@3.10.2 (current latest) requires ^2.0.2. Both are infinite-loop DoS bugs in the ICNS/JXL/HEIF parsers, reachable only at build time on images referenced from this repo's own markdown. These should stay dismissed as "no fix available" until image-size ships a release.

Verification

• pnpm install --frozen-lockfile succeeds
• pnpm run build:packages succeeds
• pnpm test: 7 suites, 35 tests pass
• pnpm run build:website:only succeeds — the load-bearing check here, since svgo and colord both sit in the CSS-minify / SVGR path

Diff is pnpm-lock.yaml only: 66 insertions, 66 deletions, consisting of the four version changes plus pnpm re-normalizing dependent keys.

🤖 Generated with Claude Code