deps(deps): bump the weekly-minor-patch group with 5 updates

[dependabot]

Bumps the weekly-minor-patch group with 5 updates:

Package	From	To
js-yaml	5.4.0	5.4.1
mermaid	11.17.1	11.17.2
openai	7.4.0	7.8.0
webpack	5.109.2	5.110.1
baseline-browser-mapping	2.11.19	2.11.20

Updates js-yaml from 5.4.0 to 5.4.1

Changelog

Sourced from js-yaml's changelog.

[5.4.1] - 2026-08-26

Changed

• Hard-limit merge sequence size to 100.

Security

• Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

Commits

• e5a3ba0 5.4.1 released
• e54dea3 Hard-limit merge sequence size to 100
• dfd3a29 Cleanup 6a8e05f, #797
• 6a8e05f fix: count empty merge sources against maxTotalMergeKeys (#797)
• See full diff in compare view

Updates mermaid from 11.17.1 to 11.17.2

Release notes

Sourced from mermaid's releases.

mermaid@11.17.2

Patch Changes

• #8125 178d7c7 Thanks @​knsv-bot! - fix: restore the edgePaths class on the edge group in rendered SVG, and point the flowchart, block and user journey stylesheets at it

Commits

• dcb694d Version Packages (#8130)
• 178d7c7 fix: restore edgePaths class on the edge group (#8125)
• See full diff in compare view

Updates openai from 7.4.0 to 7.8.0

Release notes

Sourced from openai's releases.

v7.8.0

7.8.0 (2026-08-27)

Features

• api: add compute_units to Responses and Chat Completions usage (#2505) (f9b1313)
• api: add default WebSocket User-Agent and audit log events (#2504) (9b2f089)

Bug Fixes

• auth: clamp the workload-identity refresh buffer to the token lifetime (#2490) (76b73a9)
• auth: secure first-class X.509 workload credentials (#2479) (1b36c19)
• deps: harden dependency and release boundaries (#2484) (b21ff45)
• events: settle WebSocket waiters when listeners throw (#2491) (b5a13a7)
• restore native browser ESM imports (#2495) (c8cab1e)
• uploads: detect multipart bodies from own properties only (#2492) (559ffc8)

v7.7.0

7.7.0 (2026-08-26)

Features

• api: make function call output call IDs optional (#2488) (b932ae6)

Bug Fixes

• streaming: honor cancellation while decoding SSE responses (#2487) (ababe12)

v7.6.0

7.6.0 (2026-08-26)

Features

• api: Add obfuscation field to ChatCompletionChunk (#2423) (39afa3a)
• api: Add project residency and usage quantity_unit fields (#2461) (26d8158)
• api: support backend-mediated Realtime WebRTC calls (#2469) (0d12ca8)
• auth: add pinned X.509 workload token exchange (#2470) (9dd8648)
• auth: attest cross-module X.509 transport capabilities (#2471) (c6769fa)
• auth: harden X.509 token lifecycle and tenant isolation (#2473) (6992683)
• auth: integrate attested X.509 workload identity into clients (#2472) (ee5229b)
• support named data-residency endpoints (#2393) (62d98dd)

Bug Fixes

... (truncated)

Changelog

Sourced from openai's changelog.

7.8.0 (2026-08-27)

Features

• api: add compute_units to Responses and Chat Completions usage (#2505) (f9b1313)
• api: add default WebSocket User-Agent and audit log events (#2504) (9b2f089)

Bug Fixes

• auth: clamp the workload-identity refresh buffer to the token lifetime (#2490) (76b73a9)
• auth: secure first-class X.509 workload credentials (#2479) (1b36c19)
• deps: harden dependency and release boundaries (#2484) (b21ff45)
• events: settle WebSocket waiters when listeners throw (#2491) (b5a13a7)
• restore native browser ESM imports (#2495) (c8cab1e)
• uploads: detect multipart bodies from own properties only (#2492) (559ffc8)

7.7.0 (2026-08-26)

Features

• api: make function call output call IDs optional (#2488) (b932ae6)

Bug Fixes

• streaming: honor cancellation while decoding SSE responses (#2487) (ababe12)

7.6.0 (2026-08-26)

Features

• api: Add obfuscation field to ChatCompletionChunk (#2423) (39afa3a)
• api: Add project residency and usage quantity_unit fields (#2461) (26d8158)
• api: support backend-mediated Realtime WebRTC calls (#2469) (0d12ca8)
• auth: add pinned X.509 workload token exchange (#2470) (9dd8648)
• auth: attest cross-module X.509 transport capabilities (#2471) (c6769fa)
• auth: harden X.509 token lifecycle and tenant isolation (#2473) (6992683)
• auth: integrate attested X.509 workload identity into clients (#2472) (ee5229b)
• support named data-residency endpoints (#2393) (62d98dd)

Bug Fixes

• [responses] Avoid quadratic comparisons when accumulating long text (#2434) (95628ce)
• assistants: reject run-step identity hijacking before tool callbacks (#2476) (63b1c75)
• audio: preserve recording outcomes during cancellation and cleanup (#2482) (dafcac4)

... (truncated)

Commits

• 31fae53 release: 7.8.0 (#2493)
• f9b1313 feat(api): add compute_units to Responses and Chat Completions usage (#2505)
• b21ff45 fix(deps): harden dependency and release boundaries (#2484)
• a4a80eb test: exercise direct browser imports without credentials (#2501)
• c8cab1e fix: restore native browser ESM imports (#2495)
• d691a10 test: execute webpack browser bundle without live credentials (#2498)
• 7ef99c4 test: verify packed browser bundles target ES2020 (#2496)
• b86efac ci: require keyless ecosystem checks on release PRs (#2497)
• 08f201c ci: gate npm publication on browser-compatible imports (#2500)
• 44af438 test: cover webpack ESM and CommonJS package entrypoints (#2499)
• Additional commits viewable in compare view

Updates webpack from 5.109.2 to 5.110.1

Release notes

Sourced from webpack's releases.

v5.110.1

Patch Changes

• Fix a capture-group-less snapshot.managedPaths RegExp; speed up cache writes. (by @​alexander-akait in #21843)

• Throw SyntaxError, or WebAssembly.CompileError, from an unparsable module. (by @​alexander-akait in #21847)

• Accept the optimization.minimize: true shorthand set by a plugin in apply(). (by @​AgentEnder in #21845)

v5.110.0

Minor Changes

• Wrap concatenated modules in lazy __webpack_require__.cw accessors and inline require(), keeping a wrapped body's names and side effects intact. (by @​hai-x in #21519)

• Add performance hints reporting what a build costs: duplicate packages and modules, circular dependencies, broad contexts, large modules and chunks, hotspots, eval, missing PURE annotations, polyfills, redundant dynamic imports, OS-dependent rules, cache effectiveness, how chunks load, what splitting refused, why an optimization was skipped, and rules, defines, externals, aliases and barrel reexports nothing uses. An oversized asset names its largest modules, and an entrypoint carrying the runtime recommends optimization.runtimeChunk. Enable every check not set individually with performance.all, report hints in stats only with performance.hints: "stats", and get them in a stable order that leaves the build hashes unchanged. (by @​alexander-akait in #21841)

• Add the descriptionRelativePath module rule condition. (by @​alexander-akait in #21705)

• Add OS-independent glob matching to module rules. (by @​alexander-akait in #21771)

• Report inner-graph, AMD and bare module bailouts in optimizationBailout. (by @​alexander-akait in #21740)

• Allow marking externals as side-effect-free with a sideEffects flag. (by @​alexander-akait in #21712)

• Give externals the original request of a context module element. (by @​alexander-akait in #21780)

• Add the externalsPresets.nodeModules preset with an allowlist option to externalize installed packages, replacing the webpack-node-externals plugin. (by @​alexander-akait in #21569)

• Add output.library.umdAmdContainer for an AMD-style loader branch in UMD. (by @​hai-x in #21770)

• Resolve @custom-media values that are true / false or name another custom media. (by @​alexander-akait in #21624)

• Add the __webpack_css_server_styles__ module variable to read the CSS collected while rendering without a DOM, and keep that CSS in the order the styles were applied. (by @​alexander-akait in #21576)

• Patch the HTML <head> in place on hot update instead of forcing a full reload, including when a <script> that never executed is removed. (by @​alexander-akait in #21624)

• Scope counter names in CSS modules; fix the counter() counter-style and animation timeline keywords. (by @​alexander-akait in #21600)

• Derive import defer / import source from the target and fix the source phase. (by @​alexander-akait in #21810)

• Emit analyzable ESM urls for chunks, assets, styles, workers and wasm. (by @​alexander-akait in #21788)

• Tree shake CommonJS: module.exports object literals, exports destructured from a require() binding, unused method requires, and unused side-effect-free require() calls and reexports. (by @​alexander-akait in #21841)

• Resolve relative entry baseUri values and bake one side of a hash cycle. (by @​alexander-akait in #21750)

• Minify CSS further, only where the document is unchanged: shorthands and box longhands, font-weight, <position> and font-stretch keywords, colors (polar, Lab and hsl() converted to hex), numbers, times, zero units, calc() and every math function the spec names folded over constants, selector lists, An+B, keyframe selectors, media-feature ranges, unicode-range, transition layers, display, transforms, gradients, font families, identical repeated declarations, and rules an identical later one makes dead. Abilities are read off the target browsers, vendorPrefixes adds and drops vendor prefixes for them, and rewriteCustomProperties shortens custom property values. Minification never changes whether a declaration parses, and beautifying keeps every rule. (by @​alexander-akait in #21841)

• Safely minify CSS (with source maps) and HTML assets when optimization.minimize is enabled, unless a minimizer is already configured for them, making only transformations an engine cannot tell apart. Every rewrite is named as an option, so it can be switched off. (by @​alexander-akait in #21841)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.110.1

Patch Changes

• Fix a capture-group-less snapshot.managedPaths RegExp; speed up cache writes. (by @​alexander-akait in #21843)

• Throw SyntaxError, or WebAssembly.CompileError, from an unparsable module. (by @​alexander-akait in #21847)

• Accept the optimization.minimize: true shorthand set by a plugin in apply(). (by @​AgentEnder in #21845)

5.110.0

Minor Changes

• Wrap concatenated modules in lazy __webpack_require__.cw accessors and inline require(), keeping a wrapped body's names and side effects intact. (by @​hai-x in #21519)

• Add performance hints reporting what a build costs: duplicate packages and modules, circular dependencies, broad contexts, large modules and chunks, hotspots, eval, missing PURE annotations, polyfills, redundant dynamic imports, OS-dependent rules, cache effectiveness, how chunks load, what splitting refused, why an optimization was skipped, and rules, defines, externals, aliases and barrel reexports nothing uses. An oversized asset names its largest modules, and an entrypoint carrying the runtime recommends optimization.runtimeChunk. Enable every check not set individually with performance.all, report hints in stats only with performance.hints: "stats", and get them in a stable order that leaves the build hashes unchanged. (by @​alexander-akait in #21841)

• Add the descriptionRelativePath module rule condition. (by @​alexander-akait in #21705)

• Add OS-independent glob matching to module rules. (by @​alexander-akait in #21771)

• Report inner-graph, AMD and bare module bailouts in optimizationBailout. (by @​alexander-akait in #21740)

• Allow marking externals as side-effect-free with a sideEffects flag. (by @​alexander-akait in #21712)

• Give externals the original request of a context module element. (by @​alexander-akait in #21780)

• Add the externalsPresets.nodeModules preset with an allowlist option to externalize installed packages, replacing the webpack-node-externals plugin. (by @​alexander-akait in #21569)

• Add output.library.umdAmdContainer for an AMD-style loader branch in UMD. (by @​hai-x in #21770)

• Resolve @custom-media values that are true / false or name another custom media. (by @​alexander-akait in #21624)

• Add the __webpack_css_server_styles__ module variable to read the CSS collected while rendering without a DOM, and keep that CSS in the order the styles were applied. (by @​alexander-akait in #21576)

• Patch the HTML <head> in place on hot update instead of forcing a full reload, including when a <script> that never executed is removed. (by @​alexander-akait in #21624)

• Scope counter names in CSS modules; fix the counter() counter-style and animation timeline keywords. (by @​alexander-akait in #21600)

• Derive import defer / import source from the target and fix the source phase. (by @​alexander-akait in #21810)

• Emit analyzable ESM urls for chunks, assets, styles, workers and wasm. (by @​alexander-akait in #21788)

• Tree shake CommonJS: module.exports object literals, exports destructured from a require() binding, unused method requires, and unused side-effect-free require() calls and reexports. (by @​alexander-akait in #21841)

• Resolve relative entry baseUri values and bake one side of a hash cycle. (by @​alexander-akait in #21750)

• Minify CSS further, only where the document is unchanged: shorthands and box longhands, font-weight, <position> and font-stretch keywords, colors (polar, Lab and hsl() converted to hex), numbers, times, zero units, calc() and every math function the spec names folded over constants, selector lists, An+B, keyframe selectors, media-feature ranges, unicode-range, transition layers, display, transforms, gradients, font families, identical repeated declarations, and rules an identical later one makes dead. Abilities are read off the target browsers, vendorPrefixes adds and drops vendor prefixes for them, and rewriteCustomProperties shortens custom property values. Minification never changes whether a declaration parses, and beautifying keeps every rule. (by @​alexander-akait in #21841)

... (truncated)

Commits

• 0b2952e chore(release): new release (#21846)
• 2a1fda4 fix: throw a SyntaxError from a module that failed to parse (#21847)
• 281efa6 test(css): cover a loader-added BOM in the css pipeline (#21848)
• 36ded2c fix: accept the optimization.minimize true shorthand after normalization (#21...
• c150225 fix(cache): accept a managedPaths RegExp without a capture group, and speed u...
• 3a7c0e6 chore(release): new release (#21545)
• 75891c8 chore(changesets): union same-subject entries (#21841)
• 6b96de7 feat(config): emit no development source map for library builds (#21839)
• ff0c832 feat(css,html): reach embedded source from cssMinify and htmlMinify (#21838)
• 06bedfb chore(deps): bump test/wpt in the dependencies group (#21836)
• Additional commits viewable in compare view

Updates baseline-browser-mapping from 2.11.19 to 2.11.20

Commits

• b964de0 Patch to 2.11.20 because browser or feature data changed
• 723099f Browser or feature data changed
• f44163d Updating static site
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Note

Medium Risk
Lockfile-only, but openai (used e.g. in translation tooling) and webpack (Docusaurus builds) are sensitive paths; verify builds and any OpenAI scripts after merge.

Overview
This PR only updates package-lock.json for the Dependabot weekly-minor-patch group—no package.json or app source changes.

Resolved versions move to js-yaml 5.4.1 (merge-key CPU limits / security hardening), mermaid 11.17.2 (restores edgePaths on diagram edges), openai 7.4.0 → 7.8.0 (new usage fields, auth/WebSocket/upload fixes, optional undici peer), webpack 5.110.1 (cache/minify/parsing fixes plus 5.110.0 build optimizations; drops direct eslint-scope from webpack’s tree and pulls minimizer-webpack-plugin 5.8.0 with newer terser), and baseline-browser-mapping 2.11.20 (updated browser/feature data).

^{Reviewed by Cursor Bugbot for commit aa0cf11. Bugbot is set up for automated code reviews on this repo. Configure here.}