fix(website): patch Dependabot npm advisories (serialize-javascript, uuid)#33
Merged
Conversation
The Docusaurus docs site introduced 4 transitive build-time advisories. Force patched versions via npm overrides: - serialize-javascript ^7.0.5 -> 7.0.6 (GHSA-5c6j-r48x-rmvq HIGH + GHSA-qj8w medium) - uuid ^11.1.1 (GHSA-w5hq-g745-h8pq medium) js-yaml (GHSA-h67p-54hq-rp68, medium) is intentionally NOT overridden: the only patched release (4.2.0) breaks gray-matter front-matter parsing, and the advisory is a DoS that only ever parses our own trusted doc front-matter at build time, so it carries no real risk. Documented in package.json; will clear when Docusaurus updates js-yaml upstream. All deps here are dev/build-only and never shipped in the static site. Build verified green with the overrides. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the Dependabot alerts introduced by the new Docusaurus docs site. All four are transitive build-time-only deps (Docusaurus toolchain), never shipped in the static output.
js-yaml: the only patched release (4.2.0) breaks gray-matter front-matter parsing (Docusaurus won't build). The advisory is a quadratic-DoS in YAML merge-key handling that only ever parses our own trusted doc front-matter at build time, so it carries no real-world risk. Left as-is with a documented note in
package.json; will clear when Docusaurus updates js-yaml upstream. Recommend dismissing the alert as tolerable risk.Build verified green with the overrides applied.
🤖 Generated with Claude Code