Repository navigation
Fix npm audit vulnerabilities - #383
Merged
Merged
Conversation
✅ Deploy Preview for cncf-techdocs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
chalin
force-pushed
the
chalin-m24-audit-fix-2026-0824
branch
from
August 26, 2026 17:14
67f06f3 to
ee4258e
Compare
- Resolves only within declared ranges, under the 7-day release-age cooldown - Clears both non-Docusaurus criticals (proxy-addr, shell-quote) and the image-size DoS chain - Riders: browserslist data packages, express/body-parser patch releases Signed-off-by: Patrice Chalin <pchalin@gmail.com>
- Lifts katex, smol-toml and markdownlint-cli's js-yaml past their advisories, each override staying on its current major - Pins serialize-javascript and sockjs's uuid to patched majors, since their Docusaurus parents still request the vulnerable ranges - Admits only releases older than the 7-day cooldown Signed-off-by: Patrice Chalin <pchalin@gmail.com>
- Clears the moderate advisory for the 15 copies whose parents already accept 7.x - Leaves the root 6.x copy, which the cssnano 6 chain under Docusaurus 3 still requires Signed-off-by: Patrice Chalin <pchalin@gmail.com>
- Clears both critical tinypool advisories, which npm also reports against tinypool's `@docusaurus/*` parents - Matches the tinypool 2.x range used by Docusaurus v4 canaries - Never loaded by default: Docusaurus uses tinypool only when `future.faster.ssgWorkerThreads` is on, and a forced-pool build passes on 2.2.0 Signed-off-by: Patrice Chalin <pchalin@gmail.com>
chalin
force-pushed
the
chalin-m24-audit-fix-2026-0824
branch
from
October 8, 2026 02:20
7702268 to
3bc76ec
Compare
chalin
changed the title
- Drops the webpackbar override and its postinstall notice: `@docusaurus/bundler` 3.10.2 already requires webpackbar 7, so the resolved tree is unchanged - Names, per remaining override, the parent whose update makes it removable, since npm never flags a redundant override Signed-off-by: Patrice Chalin <pchalin@gmail.com>
chalin
marked this pull request as ready for review
October 8, 2026 02:49
chalin
enabled auto-merge (squash)
October 8, 2026 02:50
Collaborator
Author
|
Ready for review @nate-double-u |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
overrideswhere a parent's range excludes the fix: katex, smol-toml, markdownlint-cli's js-yaml, tinypool; carries the existing serialize-javascript and sockjs uuid overrides, still needed@docusaurus/bundler3.10.2;package.jsonnotes when each remaining override can goftp://PAC file, dev) and braces (no fix published)typecheckfailure under TypeScript 7 (pre-existing onmain)main→ 48 (0 critical); every new version clears the 7-day cooldownfuture.faster.ssgWorkerThreads(off here); a build with the flag forced on passesnpm ci, build, format/markdown/spelling checks, unit tests, dev server