Fix Dependabot alert 66

[0mjs]

Summary

• override transitive minimatch 3.1.5 with 10.2.6
• replace vulnerable brace-expansion 1.1.16 with patched 5.0.8
• apply the one-line CommonJS import compatibility change already reviewed upstream in chore(deps): upgrade minimatch to v10.2.4 vercel/serve-handler#226
• fix high-severity Dependabot alert #66

Root cause

Docusaurus 3.9.2 depends on serve-handler 6.1.7, which pins minimatch 3.1.5 and therefore installs the vulnerable brace-expansion 1.x line. The patched brace-expansion release has a different export shape, so overriding it directly would break minimatch 3 at runtime.

This change overrides minimatch to 10.2.6, which explicitly requires brace-expansion ^5.0.8, and applies the corresponding named-import change to serve-handler through patch-package. The import change matches the upstream implementation from vercel/serve-handler#226.

Validation

• npm ci — passed; patch applies automatically
• npm audit during clean install — 0 vulnerabilities
• npm run build — passed
• npm run serve -- --port 48991 --no-open — started successfully
• HTTP smoke test of the served site — 200
• git diff --check — passed