SIGN IN SIGN UP

fix: drop obsolete resolutions whose blockers shipped (#24673)

## Summary

Housekeeping on the `resolutions` block: audits every entry against the
current tree and **removes the three whose blocker has shipped**. No
version forced anywhere new - this PR only stops forcing things that no
longer need it.

| Removed | Why it existed | Why it can go |
|---|---|---|
| `sockjs/uuid` | sockjs pinned uuid <11 with no fixed release |
**sockjs left the dependency tree entirely** - dead entry |
| `body-parser/qs` | express 4.x bundled body-parser 1.20.4 pinning `qs
~6.14.0` (below the 6.15.2 fix) | body-parser now resolves 1.20.6 /
2.3.0, whose `qs ~6.15.1` / `^6.15.2` reach the fix in range (copy lands
on 6.15.3) |
| `@istanbuljs/load-nyc-config/js-yaml` | js-yaml 3.x had **no patched
release**, so this ^3.13.1 consumer was forced onto 4.x | the 3.x line
shipped backports (**3.15.0** fixes GHSA-h67p-54hq-rp68 +
GHSA-52cp-r559-cp3m, **3.15.1** fixes GHSA-5p4m-2wfm-xmqj) - it resolves
a clean 3.15.1 naturally, and as build-only coverage tooling that is
enough |

## Deliberately kept: `front-matter/js-yaml` + the safeLoad patch

front-matter (via mintlify, parses docs content) had the same
3.x-backport escape available, but **stays forced onto js-yaml 4.3.1**:
4.x is the maintained line, while the 3.x fixes were backports to a
legacy major that future advisories may not get. The companion patch
(`loader = parser.load`) exists because 4.x removed the `safeLoad` API
front-matter's default path calls; pin and patch are a **matched pair**
- the patch without the pin would select 3.x's *unsafe* full-schema
`load` - so they only ever move together. `//resolutions` records the
split decision (unpin the build-only tool onto the backported line, keep
the docs-content parser on the maintained line).

## Verification

- `yarn.lock`: front-matter resolves the patch locator with js-yaml
forced to **4.3.1**; the `^3.13.1` entry (now load-nyc-config only)
resolves **3.15.1**; qs resolves 6.15.2 / 6.15.3 only; uuid unchanged
(11.1.1 + intentional 13.x).
- `mintlify validate` passes; front-matter parses docs front-matter at
runtime.
- `yarn install --immutable` passes.
A
Abdullah. committed
a01baa356e7c7af57e04ba999dc9e6e326017dcb
Parent: e654e02
Committed by GitHub <noreply@github.com> on 8/24/2026, 7:04:39 AM