fix(site): override vulnerable serialize-javascript and uuid

[redonkulus]

Resolves the three open Dependabot alerts (#162, #198, #201). All three are in site/package-lock.json.

Alert	Package	Severity	Advisory	Pulled in by
#162	serialize-javascript 6.0.2	high	GHSA-5c6j-r48x-rmvq: RCE via RegExp.flags / Date.prototype.toISOString()	@docusaurus/bundler → copy-webpack-plugin@11, css-minimizer-webpack-plugin@5
#201	serialize-javascript 6.0.2	moderate	GHSA-qj8w-gfj5-8c6v: CPU exhaustion DoS	same
#198	uuid 8.3.2	moderate	GHSA-w5hq-g745-h8pq: missing buffer bounds check in v3/v5/v6	@docusaurus/core → webpack-dev-server → sockjs@0.3.24

These are build-time and dev-server dependencies of the docs site only. Nothing here ships in the purecss package or runs in visitors' browsers.

Why overrides

There's no upstream release that fixes these:

• Docusaurus 3.10.2 (latest, already in use) still depends on the old plugin majors.
• sockjs hasn't had a release since 0.3.24, which requires uuid@^8.

So this adds overrides to site/package.json, the same approach the root package.json uses for lodash:

"overrides": {
  "serialize-javascript": "^7.0.5",
  "uuid": "^11.1.1"
}

• serialize-javascript → 7.1.2. The newest majors of both plugins (copy-webpack-plugin@14, css-minimizer-webpack-plugin@8) depend on ^7 themselves, so the 7.x API matches how they call it. It also drops the randombytes dependency.
• uuid → 11.1.1. sockjs only uses require('uuid').v4(), which uuid 11 still supports from CommonJS. uuid 12+ is ESM-only, so the range is capped at 11 via ^.

The lockfile diff only touches these two packages, plus randombytes being dropped.

Testing

• npm audit --omit=dev in site/: 0 vulnerabilities.
• npm run pure && npm run build: succeeds. This runs copy-webpack-plugin and css-minimizer-webpack-plugin with serialize-javascript 7.1.2.
• Site Playwright suite: 56 passed, 12 skipped.
• Started a real sockjs server and opened an xhr-polling session. It got a uuid v4 session id from uuid 11.1.1.

When Docusaurus moves to the newer plugin majors, these overrides can be removed.

🤖 Generated with Claude Code