docs/pnpm-lock.yaml had never been scanned (the nightly supply-chain
job covered uv.lock only): trivy found 116 advisories, 5 critical —
proxy-addr, shell-quote, websocket-driver, plus fast-uri, js-yaml,
brace-expansion, nanoid, lodash, path-to-regexp, picomatch, …
`pnpm update` within the existing ranges under the same 7-day release
cooldown (--config.minimum-release-age=10080), on pnpm 10.34.7:
Docusaurus 3.7 -> 3.10.2, 116 -> 7 findings.
The 7 left need majors Docusaurus pins against (tinypool 1 -> 2,
serialize-javascript 6 -> 7, uuid 8 -> 11) or a patch younger than the
cooldown (body-parser 1.20.9, 5 days): build-time / dev-server only —
uuid and body-parser sit under webpack-dev-server, which `docusaurus
build` never starts, and nothing they touch reaches the static site.
Left to upstream + Renovate rather than forced overrides.
Refs #1365
ab118d9f13