[akashreddy-nr]

Summary

Resolves open Dependabot alerts for developer-website. Jira: NR-634009. Same approach as docs-website #26125. Rebased onto develop (Node 24.22.1, #2324).

• Add resolutions for packages that exist in a single major: axios (0.34, only Gatsby pulls it in), lodash, qs, fast-uri, nanoid, immutable, js-yaml, svgo, browserslist, follow-redirects, path-to-regexp, shell-quote, and others (see package.json).
• sanitize-html resolved to ^2.18.1. Its only consumer is gatsby-transformer-remark's timeToRead, which strips HTML before counting words; the site never queries timeToRead. 2.x needs Node >= 22.12, which develop now has. This also drops postcss 7, which only sanitize-html 1.x pulled in.
• Bump direct deps within their major: gatsby ^4.25.9 (last v4), gatsby-plugin-sharp, gatsby-plugin-mdx, snyk, prismjs.
• Multi-major packages (semver, ws, ajv, yaml, minimatch, postcss, form-data, terser, cross-spawn, ...) and in-range fixes (proxy-addr, source-map-js, compression): yarn 1 can't scope a resolution to one major, so the vulnerable yarn.lock entries were removed and re-resolved to patched versions within their dependents' ranges.
• Remove unused dependencies: eslint-plugin-graphql (in .eslintrc plugins but no graphql/* rule enabled; deprecated), gatsby-plugin-offline (not in gatsby-config), fal (never imported), gatsby-transformer-remark (no .md content and no Markdown queries; content is MDX), and the direct sharp dependency (never imported). The only config changes are dropping 'graphql' from .eslintrc.js plugins and 'gatsby-transformer-remark' from gatsby-config.js.
• Bump gatsby-transformer-sharp 4.6.0 → 4.25.0 (same major, Gatsby 4).
• Path-scoped resolutions (**/parent/child) for copies pinned by one parent: ws (engine.io-client), js-cookie (@segment/analytics-next), semver (typescript-estree, core-js-compat), gatsby-plugin-sharp (theme) are same-major patches; tmp ^0.2.6, xml2js ^0.5.0, cookie ^0.7.0, uuid ^11.1.1 and serialize-javascript ^7.0.5 keep the same exported API and are still CommonJS (checked against how each consumer calls them).
• No application code changed.

Impact

• Estimated: 200 of 224 open Dependabot alerts close (re-queried 2026-10-23; to be confirmed after Dependabot rescans post-merge). 24 remain: 0 critical, 16 high, 7 medium, 1 low.

Verification (Node 24.22.1, same as CI)

• Fresh rm -rf node_modules && yarn install --frozen-lockfile (no --ignore-engines), yarn test (75 passed), yarn lint (clean), and a clean full yarn build (gatsby clean first) succeeds: sharp 0.30.7 loads, ~2,800 images are processed, _redirects has the same 46 rules.
• If you reuse an existing node_modules, run a fresh install: sharp moves to the top level, and yarn 1 doesn't re-run its binary download on an in-place install.
• Note: gatsby-source-newrelic-sdk downloads 5 SDK bundles from the CDN with no res.ok check or retry, so a stalled or error response fails the build with Unexpected token '<'. This happened intermittently during testing on both this branch and unrelated runs; a rebuild passes. It's pre-existing and not changed here.

Not in this PR (remaining 24)

• sharp 0.30.7 (4): needs 0.35, a native-module jump from what Gatsby 4's gatsby-plugin-sharp supports.
• Patched versions are ESM-only and would break Gatsby's CommonJS require: decode-uri-component (2), file-type (2).
• Dev server or Gatsby internals, major API changes: webpack-dev-middleware (2, gatsby develop only), got, postcss-selector-parser, @graphql-tools/utils, phin, nth-check, js-cookie 2 (3.x API differs; used by the theme, gatsby-plugin-gdpr-tracking, react-use).
• Old jest 26 only (dev): micromatch, @tootallnate/once. A jest 29 upgrade would clear them.
• No patched version exists: braces (2), http-cache-semantics (2), sprintf-js, lodash.pick. Candidates for dismissal with a reason.
• Theme upgrade (9.8.1 → 9.18.1) was tested and is not included: theme 9.9.0+ exports NR_SITES as undefined, which breaks MainLayout.js. Fix is in fix: export NR_SITES from constants so it is no longer undefined gatsby-theme-newrelic#1185.

🤖 Generated with Claude Code

[Nandu-pns]

Nice cleanup! I pulled this down and checked it locally (Node 24.15):

• Fresh yarn install --frozen-lockfile, yarn test (75/75), and yarn lint all pass
• Full gatsby build is clean: 414 pages, images processed fine, same 46 redirects
• Ran both lockfiles through OSV: advisories drop from 214 → 35, and nothing new gets introduced. What's left is mostly stuff pinned inside Gatsby 4.

Also checked the removals. Nothing references gatsby-transformer-remark, fal, sharp, or eslint-plugin-graphql, and gatsby-plugin-offline was never actually enabled in gatsby-config.js, so no stale service worker concerns.

One non-blocking thing for a follow-up: js-cookie@2.2.1 (GHSA-qjx8-664m-686j) is still in the browser bundle via the theme / react-use. Fixing it needs a v3 bump upstream. The direct js-cookie dep in package.json looks unused too, so it might be worth dropping.

LGTM 👍