chore(deps): consolidate open Dependabot updates

[cursor]

Gathers all currently open Dependabot PRs into a single reviewable change. Lockfile-only; no application source or package.json edits.

Included Dependabot PRs

Root

• build(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 #71 js-yaml 4.3.1 → 4.3.2 (package-lock.json)

Website (website/package-lock.json)

• build(deps): bump postcss-selector-parser in /website #64 postcss-selector-parser 6.1.2 → 6.1.4 and nested copies 7.1.0 → 7.1.5
• build(deps): bump fast-uri from 3.1.5 to 3.1.7 in /website #65 fast-uri 3.1.5 → 3.1.7
• build(deps): bump browserslist from 4.28.1 to 4.28.9 in /website #66 browserslist 4.28.1 → 4.28.9
• build(deps): bump @ai-sdk/provider-utils, @ai-sdk/react and ai in /website #67 @ai-sdk/provider-utils 3.0.17 → 3.0.36, @ai-sdk/react 2.0.97 → 2.0.256, ai 5.0.97 → 5.0.253
• build(deps): bump svgo from 3.3.4 to 3.3.5 in /website #68 svgo 3.3.4 → 3.3.5
• build(deps): bump joi from 17.13.3 to 17.13.7 in /website #69 joi 17.13.3 → 17.13.7
• build(deps): bump colord from 2.9.3 to 2.10.0 in /website #70 colord 2.9.3 → 2.10.0
• build(deps): bump js-yaml from 3.14.2 to 3.15.2 in /website #72 js-yaml 3.14.2 → 3.15.2 (nested under gray-matter; top-level website js-yaml 4.1.1 → 4.3.2)

Notes

• Cherry-picked the Dependabot commits onto master in oldest-first order; both lockfiles still install with npm ci.
• After this PR merges, the original Dependabot PRs (build(deps): bump postcss-selector-parser in /website #64–build(deps): bump js-yaml from 3.14.2 to 3.15.2 in /website #72) can be closed as superseded.

  

---

Note

Low Risk
Changes are limited to lockfile resolution; runtime behavior should stay the same aside from upstream patch-level dependency fixes.

Overview
Merges several open Dependabot bumps into lockfile-only updates—no package.json or application source changes.

Root package-lock.json: bumps dev transitive js-yaml from 4.3.1 to 4.3.2.

website/package-lock.json: refreshes resolved versions across the Docusaurus/build toolchain and nested deps, including postcss-selector-parser (6.1.4 and nested 7.1.5), browserslist / caniuse-lite / electron-to-chromium, js-yaml (top-level 4.3.2 and gray-matter’s 3.15.2), plus smaller patches (fast-uri, svgo, joi, colord, eventsource-parser, etc.). The ai / @ai-sdk/* stack also moves to newer patch releases (with @ai-sdk/provider-utils now pulling undici), along with tightened @ai-sdk/react React peer ranges.

Intent is a single reviewable dependency refresh that supersedes the individual Dependabot PRs (#64–#72).

^{Reviewed by Cursor Bugbot for commit 15fcd6b. Bugbot is set up for automated code reviews on this repo. Configure here.}