Repository navigation
fix(website): resolve npm audit vulnerabilities - #216
Merged
Merged
Conversation
Bump Docusaurus to 3.10.2 and override vulnerable transitive packages (postcss-selector-parser, qs, serialize-javascript, tinypool, uuid). Keep future.faster off: since 3.10, v4: true enables Docusaurus Faster, which needs the @docusaurus/faster package.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Mathias · project thread
Before:
npm auditinwebsite/reported 64 vulnerabilities (17 critical, 27 high, 17 moderate, 3 low).After: 28 high remain, all from a single advisory on
braces(GHSA-vfj7-8cjw-p6xm) that has no patched release yet (it covers every version up to the latest, 3.0.3). It is only reached through file globbing and watching at build/dev time, not in the published site.How:
overridesfor transitive packages Docusaurus still pins to vulnerable ranges:postcss-selector-parser^7.1.6,qs^6.16.1,serialize-javascript^7.0.5,tinypool^2.1.2,uuid^11.1.1.future.faster: falseindocusaurus.config.ts: since 3.10,v4: truealso turns Docusaurus Faster on, which requires the extra@docusaurus/fasterpackage. This keeps the existing webpack build.Checked locally (Node 22, docs copied in the way
deploy-pages.ymldoes):npm run buildsucceeds,npm run typecheckpasses,docusaurus startserves the site and its dev websocket, and the generated CSS is byte-identical withpostcss-selector-parser6 vs 7. Thetinypooloverride is only used by the opt-in SSG worker-thread mode, which stays off.Dependabot #215 overlaps on
website/; its root-directory bumps are independent of this PR.Generated by Claude Code