Problem
LFX Insights reports 38 open vulnerabilities across npm dependencies (2 critical, 19 high, 23 medium, 8 low, median CVSS 6.2). A local npm audit on current master confirms 47 findings (2 critical, 11 high, 33 moderate, 1 low).
All of them are in the Docusaurus build toolchain (transitive deps such as webpack-dev-server, undici, ws, minimatch, node-tar, fast-uri, shell-quote, js-yaml, serialize-javascript). The published site is static HTML, so runtime exposure is low, but the findings are fixable and keep the security score red.
Status
Note for maintainers: #555 and #556 both touch package-lock.json, so whichever merges second needs a trivial rebase.
Ref: https://insights.linuxfoundation.org/project/hami/repository/project-hami_website/security
Problem
LFX Insights reports 38 open vulnerabilities across npm dependencies (2 critical, 19 high, 23 medium, 8 low, median CVSS 6.2). A local
npm auditon current master confirms 47 findings (2 critical, 11 high, 33 moderate, 1 low).All of them are in the Docusaurus build toolchain (transitive deps such as
webpack-dev-server,undici,ws,minimatch,node-tar,fast-uri,shell-quote,js-yaml,serialize-javascript). The published site is static HTML, so runtime exposure is low, but the findings are fixable and keep the security score red.Status
npm audit fixfor the tooling vulnerabilities (open since Jul 5)websocket-driver,fast-uri,svgo,linkify-it,webpack-dev-server,body-parser,brace-expansion), so chore: npm audit fix for dev tooling vulnerabilities #556 will be refreshed against latest master to cover themNote for maintainers: #555 and #556 both touch
package-lock.json, so whichever merges second needs a trivial rebase.Ref: https://insights.linuxfoundation.org/project/hami/repository/project-hami_website/security