Skip to content

chore: npm audit fix for dev tooling vulnerabilities#556

Open
mesutoezdil wants to merge 2 commits into
Project-HAMi:masterfrom
mesutoezdil:chore/npm-audit-fix
Open

chore: npm audit fix for dev tooling vulnerabilities#556
mesutoezdil wants to merge 2 commits into
Project-HAMi:masterfrom
mesutoezdil:chore/npm-audit-fix

Conversation

@mesutoezdil

@mesutoezdil mesutoezdil commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

What

Runs npm audit fix (no --force, no semver-major changes) against latest master. Only package-lock.json changes.

Why

LFX Insights reports 38 open dependency vulnerabilities for this repo. This PR resolves 20 of the 47 local npm audit findings, including both critical ones (shell-quote, websocket-driver) and most high-severity ones (ws, undici, fast-uri, brace-expansion, linkify-it, svgo, minimatch, node-tar).

Refreshed on Jul 22 to cover advisories published Jul 15-21.

The remaining 27 findings (25 moderate, 2 high) are transitive deps of the Docusaurus toolchain (webpack-dev-server, serialize-javascript, js-yaml via markdownlint-cli) and need breaking upgrades, tracked in #628.

Testing

npm run build:fast passes after the change.

Part of #628

@netlify

netlify Bot commented Jul 5, 2026

Copy link
Copy Markdown

Deploy Preview for project-hami ready!

Name Link
🔨 Latest commit 3535100
🔍 Latest deploy log https://app.netlify.com/projects/project-hami/deploys/6a63991d5948a800086356d1
😎 Deploy Preview https://deploy-preview-556--project-hami.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@hami-robot
hami-robot Bot requested review from rootsongjc and windsonsea July 5, 2026 14:31
@hami-robot

hami-robot Bot commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mesutoezdil
Once this PR has been reviewed and has the lgtm label, please assign wawa0210 for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@hami-robot hami-robot Bot added the size/XXL label Jul 5, 2026
@coderabbitai

coderabbitai Bot commented Jul 5, 2026

Copy link
Copy Markdown

Review Change Stack

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0663918e-90e2-48f7-aa29-3b3c30cc0d40

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

This PR updates package.json to bump Docusaurus-related dependency and devDependency versions from 3.10.0 to ^3.10.1, affecting @docusaurus/core, content/plugin/preset packages, sitemap, theme-mermaid, and @docusaurus/faster.

Changes

Dependency version bump

Layer / File(s) Summary
Bump Docusaurus package versions
package.json
Updates @docusaurus/* dependencies and @docusaurus/faster devDependency from 3.10.0 to ^3.10.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

Hop, hop, version bump so neat,
3.10.1, a tiny treat 🐇
No logic changed, just numbers spun,
A rabbit's chore, quickly done!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title is related to the dependency maintenance changes, though it emphasizes audit fixes more than the Docusaurus version bump.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Refreshed against latest master to cover advisories published
through Jul 21. Resolves 20 of 47 npm audit findings including
both critical ones. Remaining findings need breaking upgrades
in the Docusaurus toolchain.

Signed-off-by: mesutoezdil <mesudozdil@gmail.com>
@mesutoezdil
mesutoezdil force-pushed the chore/npm-audit-fix branch from 016b0a6 to 885bf5f Compare July 22, 2026 11:55
Copilot AI review requested due to automatic review settings July 22, 2026 11:55

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants