From 19d9f651f2a5ed09c0342d2b4edc5e2d23c45051 Mon Sep 17 00:00:00 2001
From: Mike Fortman <mfortman11@gmail.com>
Date: Mon, 19 Oct 2026 13:20:02 -0500
Subject: [PATCH 1/2] fix CVE-2026-93748

---
 docs/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/package-lock.json b/docs/package-lock.json
index 5f1ac4fc2..d0689fc18 100644
--- a/docs/package-lock.json
+++ b/docs/package-lock.json
@@ -10515,9 +10515,9 @@
       }
     },
     "node_modules/http-cache-semantics": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
-      "integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.3.0.tgz",
+      "integrity": "sha512-M5t5LlJpS1UHMjvwRQVdFHvPISGeLAxNcrWuJkeGh0KxsqCHZ1O3NXZU/8x7cD0BDcGW8kapxMKTvwlqrNkHkA==",
       "license": "BSD-2-Clause"
     },
     "node_modules/http-deceiver": {

From f169061b5fa7493d650c384158dac84be3eb5850 Mon Sep 17 00:00:00 2001
From: Mike Fortman <mfortman11@gmail.com>
Date: Mon, 19 Oct 2026 14:58:44 -0500
Subject: [PATCH 2/2] address CVE-2026-93753

---
 docs/package-lock.json                   | 15 ++++++++-------
 docs/package.json                        |  2 ++
 docs/stubs/deepmerge-unused/index.js     |  6 ++++++
 docs/stubs/deepmerge-unused/package.json |  8 ++++++++
 4 files changed, 24 insertions(+), 7 deletions(-)
 create mode 100644 docs/stubs/deepmerge-unused/index.js
 create mode 100644 docs/stubs/deepmerge-unused/package.json

diff --git a/docs/package-lock.json b/docs/package-lock.json
index d0689fc18..aa792e090 100644
--- a/docs/package-lock.json
+++ b/docs/package-lock.json
@@ -25,6 +25,7 @@
         "@docusaurus/tsconfig": "3.10.2",
         "@docusaurus/types": "3.10.2",
         "baseline-browser-mapping": "^2.11.0",
+        "deepmerge": "file:./stubs/deepmerge-unused",
         "typescript": "~6.0.3"
       },
       "engines": {
@@ -8695,13 +8696,8 @@
       }
     },
     "node_modules/deepmerge": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
-      "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
+      "resolved": "stubs/deepmerge-unused",
+      "link": true
     },
     "node_modules/default-browser": {
       "version": "5.5.0",
@@ -19469,6 +19465,11 @@
         "type": "github",
         "url": "https://github.com/sponsors/wooorm"
       }
+    },
+    "stubs/deepmerge-unused": {
+      "name": "openrag-docs-deepmerge-unused",
+      "version": "1.0.0",
+      "license": "Apache-2.0"
     }
   }
 }
diff --git a/docs/package.json b/docs/package.json
index 232aaf2fe..c44a2b740 100644
--- a/docs/package.json
+++ b/docs/package.json
@@ -33,6 +33,7 @@
     "@docusaurus/tsconfig": "3.10.2",
     "@docusaurus/types": "3.10.2",
     "baseline-browser-mapping": "^2.11.0",
+    "deepmerge": "file:./stubs/deepmerge-unused",
     "typescript": "~6.0.3"
   },
   "overrides": {
@@ -58,6 +59,7 @@
     "brace-expansion": "1.1.21",
     "undici": "8.11.2",
     "follow-redirects": "^1.16.0",
+    "deepmerge": "$deepmerge",
     "svgo": "3.3.5",
     "dompurify": "^3.4.11",
     "mermaid": "11.16.1",
diff --git a/docs/stubs/deepmerge-unused/index.js b/docs/stubs/deepmerge-unused/index.js
new file mode 100644
index 000000000..5ced13cde
--- /dev/null
+++ b/docs/stubs/deepmerge-unused/index.js
@@ -0,0 +1,6 @@
+// deepmerge is overridden with this stub in docs/package.json because nothing
+// in the docs build imports it (CVE-2026-93753). If a dependency starts to,
+// fail loudly so the override gets revisited instead of merging silently.
+throw new Error(
+  "deepmerge is stubbed out in docs/package.json overrides; a dependency now imports it, so remove the override and re-check CVE-2026-93753."
+);
diff --git a/docs/stubs/deepmerge-unused/package.json b/docs/stubs/deepmerge-unused/package.json
new file mode 100644
index 000000000..dd2d454d1
--- /dev/null
+++ b/docs/stubs/deepmerge-unused/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "openrag-docs-deepmerge-unused",
+  "version": "1.0.0",
+  "private": true,
+  "description": "Stands in for deepmerge, which @svgr/plugin-svgo 8.1.0 declares but never imports. Replaces it so CVE-2026-93753 has nothing to flag.",
+  "main": "index.js",
+  "license": "Apache-2.0"
+}