chore: npm audit fix for dev tooling vulnerabilities#556
Conversation
✅ Deploy Preview for project-hami ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: mesutoezdil The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThis PR updates package.json to bump Docusaurus-related dependency and devDependency versions from 3.10.0 to ^3.10.1, affecting ChangesDependency version bump
Estimated code review effort: 1 (Trivial) | ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
0cc4693 to
8d22762
Compare
Refreshed against latest master to cover advisories published through Jul 21. Resolves 20 of 47 npm audit findings including both critical ones. Remaining findings need breaking upgrades in the Docusaurus toolchain. Signed-off-by: mesutoezdil <mesudozdil@gmail.com>
016b0a6 to
885bf5f
Compare
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
What
Runs
npm audit fix(no--force, no semver-major changes) against latest master. Onlypackage-lock.jsonchanges.Why
LFX Insights reports 38 open dependency vulnerabilities for this repo. This PR resolves 20 of the 47 local
npm auditfindings, including both critical ones (shell-quote,websocket-driver) and most high-severity ones (ws,undici,fast-uri,brace-expansion,linkify-it,svgo,minimatch,node-tar).Refreshed on Jul 22 to cover advisories published Jul 15-21.
The remaining 27 findings (25 moderate, 2 high) are transitive deps of the Docusaurus toolchain (
webpack-dev-server,serialize-javascript,js-yamlviamarkdownlint-cli) and need breaking upgrades, tracked in #628.Testing
npm run build:fastpasses after the change.Part of #628