[jaygiang]

Problem

• The docs repo has 18 open Dependabot security PRs that were never merged, and the lockfile hadn't been updated since February
• package.json still had an overrides entry for docusaurus-plugin-remote-content, which was uninstalled in February

Fix

• Ran npm audit fix to apply all non-breaking security updates. This also brings Docusaurus from 3.9.2 to 3.10.2 (latest), within the existing ^3.9.2 range, so only package-lock.json changes
• Removed the unused docusaurus-plugin-remote-content override. The lockfile is unchanged by this, confirming it wasn't doing anything
• Verified npm run build passes

Notes

• The remaining audit findings (46: 15 moderate, 15 high, 16 critical) are all inside Docusaurus's own build tooling (webpack-dev-server, cssnano, serialize-javascript, tinypool, etc.). They only run at build time, not on the published site, and need an upstream Docusaurus update to clear
• npm audit fix --force is not used because it would downgrade @docusaurus/core to 3.7.0
• Once merged, Dependabot should close the PRs this covers. Leftover alerts can be dismissed as build-time only