[ctauchen]

Raises the dompurify and js-yaml resolutions to patched versions, and removes the mermaid theme, which no page uses. This closes 17 Dependabot alerts (dompurify, js-yaml 4, katex, tmp).

https://tigera.atlassian.net/browse/DOCS-3131

Preview: https://deploy-preview-3152--tigera.netlify.app/calico/latest/reference/rest-api-reference/

• Part 3 of 5, stacked on DOCS-3131: Refresh vulnerable transitive dependencies within range #3151. Merge in order.
• No .md or .mdx file in any version has a mermaid block.
• patch-package/tmp overrides the tmp copy in swagger-ui-react 4's patch-package, which never runs. Part 5 removes it.
• Local clean build: the HTML for all 2982 pages matches main. Only the mermaid JS chunks are gone.
• REST API reference pages render and expand operations, with the same console output as main.
• To rebuild the lockfile after a rebase: yarn install.

[netlify]

✅ Deploy Preview for calico-docs-preview-next ready!

Name	Link
🔨 Latest commit	96cc29c
🔍 Latest deploy log	https://app.netlify.com/projects/calico-docs-preview-next/deploys/6ad9f98046f091ba555d9bf1
😎 Deploy Preview	https://deploy-preview-3152--calico-docs-preview-next.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview succeeded!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	96cc29c
🔍 Latest deploy log	https://app.netlify.com/projects/tigera/deploys/6ad9f980058749fe7dd11805
😎 Deploy Preview	https://deploy-preview-3152--tigera.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 65 (🔴 down 30 from production) Accessibility: 98 (no change from production) Best Practices: 92 (no change from production) SEO: 100 (no change from production) PWA: - View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

🟡 Changes recommended

The critical tinypool major-version compatibility issue must be resolved before approval.

1 open issue

• Avoid forcing tinypool 2.x against Docusaurus's 1.x contract · New

What changed in this PR

This pull request raises dependency resolutions for patched dompurify and js-yaml versions, removes the unused Mermaid integration, and refreshes the lockfile.

Changes:

• Updates security-related dependency resolutions and transitive packages.
• Removes the unused Mermaid theme and Markdown configuration.
• Removes Mermaid-related packages from yarn.lock.
• Adds tmp and tinypool resolutions.

The tinypool resolution in package.json forces version 2.2.0 while Docusaurus still declares compatibility with ^1.0.2, creating a critical dependency-contract risk that must be addressed.

File	Description
yarn.lock	Records patched dependency versions and removes unused Mermaid-related packages.
package.json	Updates dependency resolutions and removes the Mermaid theme dependency; the tinypool resolution requires correction or a compatible Docusaurus upgrade.
docusaurus.config.js	Removes Mermaid Markdown support and theme registration.

_{Review effort: Lite}

[ctauchen]

This override comes from #3150. A clean local build with DOCUSAURUS_PERF_LOGGER=true showed the 10-thread SSG pool running all 297 tasks on tinypool 2.2.0. The HTML for all 2982 pages matched main. Docusaurus 3.10.1 uses only options that tinypool 2 still supports, and the Docusaurus 4 canary already depends on tinypool ^2.1.2.