fix: override @azure/identity in docs to resolve msal-browser vulnerability

[frankmueller-msft]

Summary

• Overrides @azure/identity to ^4.13.0 in docs workspace to resolve a known vulnerability in @azure/msal-browser@3.30.0
• No patched @azure/msal-browser 3.x exists — the newer identity version pulls msal-browser@5.6.1 which is patched
• The vulnerable 3.30.0 was a transitive dependency via @azure/static-web-apps-cli → @azure/identity@4.5.0

Test plan

• CI passes across all workspace pipelines
• Link check passes
• No functional changes — override only affects transitive dependency resolution

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the docs workspace dependency overrides to eliminate a transitive @azure/msal-browser@3.x vulnerability by forcing a newer @azure/identity version.

Changes:

• Add an override to pin @azure/identity to ^4.13.0 in docs/package.json
• Document the rationale for the override in the “why” comment list

Files not reviewed (1)

• docs/pnpm-lock.yaml: Language not supported

[Copilot]

Overriding @azure/identity to a higher major/minor than what upstream packages request can introduce runtime incompatibilities for any consumer that expects the older transitive @azure/identity API/behavior (even in docs tooling like @azure/static-web-apps-cli). Consider scoping the override to only the vulnerable chain (if your package manager supports targeted overrides), or also adding a short note in the override rationale/comments about which top-level dependency requires the older version and why ^4.13.0 is known to be compatible in this repo’s docs build.

Suggested change

	"@azure/identity: overridden to ^4.13.0 to pull a patched @azure/msal-browser (no patched 3.x exists)."
	"@azure/identity: overridden to ^4.13.0 to pull a patched @azure/msal-browser (no patched 3.x exists). ^4.13.0 has been verified to be API-compatible with all @azure/identity consumers in this docs build."

[frankmueller-msft]

Good suggestion — updated the comment to note that @azure/static-web-apps-cli is the consumer and that ^4.13.0 is within its declared ^4.3.0 range.

[github-actions]

🔗 No broken links found! ✅

Your attention to detail is admirable.

linkcheck output

> fluid-framework-docs-site@0.0.0 ci:check-links /home/runner/work/FluidFramework/FluidFramework/docs
> start-server-and-test "npm run serve -- --no-open" 3000 check-links

1: starting server using command "npm run serve -- --no-open"
and when url "[ 'http://127.0.0.1:3000' ]" is responding with HTTP status code 200
running tests using command "npm run check-links"


> fluid-framework-docs-site@0.0.0 serve
> docusaurus serve --no-open

[SUCCESS] Serving "build" directory at: http://localhost:3000/

> fluid-framework-docs-site@0.0.0 check-links
> linkcheck http://localhost:3000 --skip-file skipped-urls.txt

Crawling...

Stats:
  272202 links
    1863 destination URLs
    2108 URLs ignored
       0 warnings
       0 errors