Fix npm security vulnerabilities in website dependencies (ws, js-yaml)

[Copilot]

Several high/moderate severity npm CVEs in website/yarn.lock needed patching. Addressed by adding/updating resolutions entries in website/package.json and regenerating yarn.lock.

Changes

• ws (High — Memory exhaustion DoS, Migrate test_testutil.py to pyre-strict mode #158/Migrate test_stats_and_plots.py to pyre-strict mode #159): Added "ws": ">=8.21.0" resolution; all ws ranges (^7.3.1, ^8.18.0) now consolidate to 8.21.1.
• js-yaml (High/Moderate — quadratic CPU DoS on merge-key chains, [FEATURE] add copilot review to be run automatically (with custom prompt) #173/[FEATURE] Change Sample and BalanceDF roles #182): Bumped resolution from ^3.14.2 → ^3.15.0; resolves to 3.15.0.

Already covered by existing resolutions (no change needed)

Package	Alerts	Pinned to
http-proxy-middleware	#164, #172	>=2.0.9
webpack-dev-server	#166, #184, #185	5.2.4

Out of scope

@babel/core (#160, Low): adding >=7.26.10 caused resolution to jump to 8.0.1 (major breaking change). The advisory DB does not flag the version in use as vulnerable; deferred.

[Copilot]

Pull request overview

Updates the documentation website’s Yarn-managed dependency graph to remediate reported npm security advisories by adjusting resolutions and regenerating the lockfile.

Changes:

• Added a ws resolution to enforce a patched version across transitive consumers.
• Bumped the js-yaml resolution to a patched 3.x version.
• Regenerated website/yarn.lock to reflect the updated resolution constraints (including consolidation to ws@8.21.1 and js-yaml@3.15.0).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
website/package.json	Updates Yarn resolutions for ws and js-yaml to address advisories.
website/yarn.lock	Lockfile refresh to apply the new resolutions and updated transitive versions.

[meta-codesync]

@talgalili has imported this pull request. If you are a Meta employee, you can view this in D113003265.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

[facebook-github-tools]

@Copilot has updated the pull request. You must reimport the pull request before landing.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

[facebook-github-tools]

@Copilot has updated the pull request. You must reimport the pull request before landing.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

website/package.json:79

• The PR description says the fix is a global ws resolution (">=8.21.0") and a global js-yaml resolution bump, but package.json actually introduces package-scoped resolutions (webpack-dev-server/ws, @docusaurus/core/webpack-bundle-analyzer/ws, gray-matter/js-yaml) and uses ^8.21.1/^3.15.0 ranges. This mismatch makes it hard to verify the intended scope of the security pin (global vs only those transitive paths).

    "webpack-dev-server/ws": "^8.21.1",
    "@docusaurus/core/webpack-bundle-analyzer/ws": "^8.21.1",
    "gray-matter/js-yaml": "^3.15.0",

[meta-codesync]

@talgalili merged this pull request in 31cb9b2.