[timdegroot1996]

Resolves Dependabot alerts #29, #30, #31 and #32.

Problem

Four open Dependabot alerts, all in package-lock.json and all development-only (VitePress docs site and Vitest). None of these packages are shipped in the generated dashboard, the server or the Python package.

Alert	Package	Severity	Advisory	Fixed in
#30	source-map-js 1.2.1	high	GHSA-68fv-2mgg-jv7q, event-loop DoS via indexed source-map section offsets	1.2.2
#31	katex 0.16.47	low	GHSA-238p-pmpm-9mq7, prototype pollution can bypass trust restrictions	0.18.2
#29	dompurify 3.4.15	low	GHSA-p98j-92pf-mc4p, IN_PLACE hook leaves event handlers armed	3.4.16
#32	dompurify 3.4.15	low	GHSA-6688-9rhm-gjv2, IN_PLACE rawtext root reparse	3.4.16

Fix

• mermaid ^12.0.0 → ^12.2.0. mermaid 12.0 required katex ^0.16, which has no patched release; 12.2 requires katex ^0.18. Resolves to katex 0.18.10 and dompurify 3.4.17.
• source-map-js 1.2.1 → 1.2.2 through postcss (vite) and the Vue compiler, lockfile only.
• The lockfile was regenerated in node:24 on Linux, so the optional native binaries for other platforms stay in it and npm ci in CI keeps working.

Tests

In node:24 from a clean npm ci:

• npm audit: found 0 vulnerabilities
• npm run docs:build: build complete
• npm run test:js: 24 files, 480 passed
• I served the built site under /robotframework-dashboard/ and opened it in Chromium. The 3 mermaid diagrams on the Architecture page render to SVG. The only 404 is versions.json, which only the versioned deploy build creates.

🤖 Generated with Claude Code