Skip to content

chore(deps): bump webpack-dev-server, @docusaurus/core and @docusaurus/preset-classic#30

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-a2018f8763
Open

chore(deps): bump webpack-dev-server, @docusaurus/core and @docusaurus/preset-classic#30
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-a2018f8763

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github May 19, 2026

Bumps webpack-dev-server to 5.2.4 and updates ancestor dependencies webpack-dev-server, @docusaurus/core and @docusaurus/preset-classic. These dependencies need to be updated together.

Updates webpack-dev-server from 3.11.2 to 5.2.4

Release notes

Sourced from webpack-dev-server's releases.

v5.2.4

5.2.4 (2026-05-11)

Bug Fixes

  • set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

v5.2.3

5.2.3 (2026-01-12)

Bug Fixes

  • add cause for errorObject (#5518) (37b033d)
  • compatibility with event target and universal target and lazy compilation (574026c)
  • overlay: add ESC key to dismiss overlay (#5598) (f91baa8)
  • progress indicator styles (#5557) (41a53a1)
  • upgrade selfsigned to v5

v5.2.2

5.2.2 (2025-06-03)

Bug Fixes

  • "Overlay enabled" false positive (18e72ee)
  • do not crush when error is null for runtime errors (#5447) (309991f)
  • remove unnecessary header X_TEST (#5451) (64a6124)
  • respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

v5.2.1

5.2.1 (2025-03-26)

Security

  • cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header
  • requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

  • prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)
  • take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)

v5.2.0

5.2.0 (2024-12-11)

Features

... (truncated)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.4 (2026-05-11)

Bug Fixes

  • set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

5.2.3 (2026-01-12)

Bug Fixes

  • add cause for errorObject (#5518) (37b033d)
  • compatibility with event target and universal target and lazy compilation (574026c)
  • overlay: add ESC key to dismiss overlay (#5598) (f91baa8)
  • progress indicator styles (#5557) (41a53a1)
  • upgrade selfsigned to v5

5.2.2 (2025-06-03)

Bug Fixes

  • "Overlay enabled" false positive (18e72ee)
  • do not crush when error is null for runtime errors (#5447) (309991f)
  • remove unnecessary header X_TEST (#5451) (64a6124)
  • respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

5.2.1 (2025-03-26)

Security

  • cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header
  • requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

  • prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)
  • take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)

5.2.0 (2024-12-11)

Features

  • added getClientEntry and getClientHotEntry methods to get clients entries (dc642a8)

Bug Fixes

... (truncated)

Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates @docusaurus/core from 2.0.0-beta.4 to 3.10.1

Release notes

Sourced from @​docusaurus/core's releases.

3.10.1 (2026-04-30)

🐛 Bug Fix

  • docusaurus-bundler
    • #11981 fix(bundler): fix v3 webpackbar bug due to webpack breaking change (@​slorber)

🔧 Maintenance

  • docusaurus

Committers: 1

3.10.0 (2026-04-07)

🚀 New Feature

  • docusaurus-types, docusaurus
    • #11896 feat(core): add future.v4.mdx1CompatDisabledByDefault flag (@​slorber)
    • #11797 feat(core): promote siteConfig.storage to stable + add future.v4.siteStorageNamespacing flag [Claude] (@​slorber)
    • #11571 feat(core): support custom html elements in head tags (@​lebalz)
  • create-docusaurus
    • #11897 feat(create-docusaurus): update init template to .mdx extension and strict MDX syntax (@​slorber)
    • #11696 feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (@​slorber)
    • #11611 feat(create-docusaurus): enable creation in current directory (@​Mcheung7272)
  • Other
    • #11874 feat(ci): improve npm supply chain security - improve Dependabot config (@​slorber)
    • #11712 feat(publish): Use trusted publishing (OIDC) for canary releases (@​slorber)
  • create-docusaurus, docusaurus-bundler, docusaurus-plugin-content-blog, docusaurus-plugin-content-docs, docusaurus-plugin-content-pages, docusaurus-plugin-pwa, docusaurus-types, docusaurus
    • #11802 feat(core): Docusaurus Faster is stable + v4 future flag turns it on by default (@​slorber)
  • docusaurus-mdx-loader, docusaurus-utils, docusaurus
    • #11777 feat(cli): write-heading-ids CLI now supports the --syntax and --migrate options (@​slorber)
  • docusaurus-mdx-loader
    • #11755 feat(mdx-loader): add support for explicit headingId based on MD/MDX comments (@​slorber)
  • docusaurus-theme-live-codeblock, docusaurus-theme-translations
  • docusaurus-theme-classic, docusaurus-theme-common
    • #11734 feat(theme): Split <DocCard>, improve extensibility, better handling of emoji icons, stable classNames (@​slorber)
    • #11733 feat(theme): Use React context for <Tabs>, allow custom <TabItem> components (@​slorber)
  • docusaurus-faster, docusaurus
    • #11715 feat(bundler): upgrade to Rspack 1.7, remove useless experimental feature flags (@​slorber)
  • docusaurus-plugin-content-pages
  • docusaurus-mdx-loader, docusaurus-theme-classic
    • #11642 feat(mdx-loader): add admonitions directive support for class/id shortcuts (@​lebalz)
  • docusaurus-theme-classic

... (truncated)

Changelog

Sourced from @​docusaurus/core's changelog.

Docusaurus Changelog - v2.x

2.4.3 (2023-09-20)

🐛 Bug Fix

  • docusaurus-plugin-content-docs
    • #9107 fix(content-docs): sidebar generator should return customProps for doc items (@​TheCatLady)
  • docusaurus-theme-classic
    • #9108 feat(theme-classic): add description & keywords microdata to blog posts (@​TheCatLady)
    • #9099 fix(theme): only set classname on ul elements if they have an existing class (@​homotechsual)
    • #9243 fix(theme-common): ThemedComponent should display something when JS is disabled (@​slorber)
  • docusaurus-theme-classic, docusaurus-theme-common
    • #9130 fix(theme): canonical url should be not change after hydration if url accessed with/without trailing slash (@​ori-shalom)

Committers: 4

2.4.2 (2023-09-20)

Bad npm publish, please use 2.4.3

2.4.1 (2023-05-15)

🐛 Bug Fix

  • docusaurus-theme-classic, docusaurus-theme-common
    • #8971 fix(theme): fix collapsible sidebar behavior when prefers-reduced-motion (@​slorber)
  • docusaurus-theme-translations
  • docusaurus
  • docusaurus-plugin-content-blog, docusaurus-theme-common, docusaurus-utils-common, docusaurus
    • #8909 fix(theme): add __ prefix to technical anchors, search crawlers (Algolia) should ignore them (@​slorber)
  • docusaurus-theme-common
    • #8906 fix(theme-common): fix collapsible component with prefers-reduced-motion (@​slorber)
    • #8873 fix(theme-common): fix confusing theme error message: bad sidebar id suggestions (@​slorber)
  • docusaurus-utils
    • #8874 fix(utils): handle Markdown links with spaces to route correctly (@​morsko1)
  • docusaurus-theme-classic, docusaurus-theme-translations
  • create-docusaurus

💅 Polish

... (truncated)

Commits
  • 41c1a45 v3.10.1
  • d4164ae chore: cherry-pick commits for v3.10.1 patch release (#11982)
  • 4892e7f feat(core): add future.v4.mdx1CompatDisabledByDefault flag (#11896)
  • 543eaeb fix(core): fix url.resolve() Node.js deprecation warning (#11844)
  • 1a52592 fix(faster): upgrade Rspack, fix Yarn PnP support (#11817)
  • 4a0273f fix(create-docusaurus): fix support for TypeScript 6.0 + fix our CI (#11843)
  • f659aef fix(core): upgrade serve handler min version to for upgrade users to a secure...
  • 1451780 chore(ci): fixes for the npm trusted publishing workflow (#11823)
  • 5dff744 chore(ci): add Trusted Publishing release workflow through dispatch action (#...
  • 29c3b5c feat(core): Docusaurus Faster is stable + v4 future flag turns it on by defau...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​docusaurus/core since your current version.


Updates @docusaurus/preset-classic from 2.0.0-beta.4 to 3.10.1

Release notes

Sourced from @​docusaurus/preset-classic's releases.

3.10.1 (2026-04-30)

🐛 Bug Fix

  • docusaurus-bundler
    • #11981 fix(bundler): fix v3 webpackbar bug due to webpack breaking change (@​slorber)

🔧 Maintenance

  • docusaurus

Committers: 1

3.10.0 (2026-04-07)

🚀 New Feature

  • docusaurus-types, docusaurus
    • #11896 feat(core): add future.v4.mdx1CompatDisabledByDefault flag (@​slorber)
    • #11797 feat(core): promote siteConfig.storage to stable + add future.v4.siteStorageNamespacing flag [Claude] (@​slorber)
    • #11571 feat(core): support custom html elements in head tags (@​lebalz)
  • create-docusaurus
    • #11897 feat(create-docusaurus): update init template to .mdx extension and strict MDX syntax (@​slorber)
    • #11696 feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (@​slorber)
    • #11611 feat(create-docusaurus): enable creation in current directory (@​Mcheung7272)
  • Other
    • #11874 feat(ci): improve npm supply chain security - improve Dependabot config (@​slorber)
    • #11712 feat(publish): Use trusted publishing (OIDC) for canary releases (@​slorber)
  • create-docusaurus, docusaurus-bundler, docusaurus-plugin-content-blog, docusaurus-plugin-content-docs, docusaurus-plugin-content-pages, docusaurus-plugin-pwa, docusaurus-types, docusaurus
    • #11802 feat(core): Docusaurus Faster is stable + v4 future flag turns it on by default (@​slorber)
  • docusaurus-mdx-loader, docusaurus-utils, docusaurus
    • #11777 feat(cli): write-heading-ids CLI now supports the --syntax and --migrate options (@​slorber)
  • docusaurus-mdx-loader
    • #11755 feat(mdx-loader): add support for explicit headingId based on MD/MDX comments (@​slorber)
  • docusaurus-theme-live-codeblock, docusaurus-theme-translations
  • docusaurus-theme-classic, docusaurus-theme-common
    • #11734 feat(theme): Split <DocCard>, improve extensibility, better handling of emoji icons, stable classNames (@​slorber)
    • #11733 feat(theme): Use React context for <Tabs>, allow custom <TabItem> components (@​slorber)
  • docusaurus-faster, docusaurus
    • #11715 feat(bundler): upgrade to Rspack 1.7, remove useless experimental feature flags (@​slorber)
  • docusaurus-plugin-content-pages
  • docusaurus-mdx-loader, docusaurus-theme-classic
    • #11642 feat(mdx-loader): add admonitions directive support for class/id shortcuts (@​lebalz)
  • docusaurus-theme-classic

... (truncated)

Changelog

Sourced from @​docusaurus/preset-classic's changelog.

Docusaurus Changelog - v2.x

2.4.3 (2023-09-20)

🐛 Bug Fix

  • docusaurus-plugin-content-docs
    • #9107 fix(content-docs): sidebar generator should return customProps for doc items (@​TheCatLady)
  • docusaurus-theme-classic
    • #9108 feat(theme-classic): add description & keywords microdata to blog posts (@​TheCatLady)
    • #9099 fix(theme): only set classname on ul elements if they have an existing class (@​homotechsual)
    • #9243 fix(theme-common): ThemedComponent should display something when JS is disabled (@​slorber)
  • docusaurus-theme-classic, docusaurus-theme-common
    • #9130 fix(theme): canonical url should be not change after hydration if url accessed with/without trailing slash (@​ori-shalom)

Committers: 4

2.4.2 (2023-09-20)

Bad npm publish, please use 2.4.3

2.4.1 (2023-05-15)

🐛 Bug Fix

  • docusaurus-theme-classic, docusaurus-theme-common
    • #8971 fix(theme): fix collapsible sidebar behavior when prefers-reduced-motion (@​slorber)
  • docusaurus-theme-translations
  • docusaurus
  • docusaurus-plugin-content-blog, docusaurus-theme-common, docusaurus-utils-common, docusaurus
    • #8909 fix(theme): add __ prefix to technical anchors, search crawlers (Algolia) should ignore them (@​slorber)
  • docusaurus-theme-common
    • #8906 fix(theme-common): fix collapsible component with prefers-reduced-motion (@​slorber)
    • #8873 fix(theme-common): fix confusing theme error message: bad sidebar id suggestions (@​slorber)
  • docusaurus-utils
    • #8874 fix(utils): handle Markdown links with spaces to route correctly (@​morsko1)
  • docusaurus-theme-classic, docusaurus-theme-translations
  • create-docusaurus

💅 Polish

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​docusaurus/preset-classic since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump webpack-dev-server, @docusaurus/core and @docusauru…
485b87e 
…s/preset-classic

Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) to 5.2.4 and updates ancestor dependencies [webpack-dev-server](https://github.com/webpack/webpack-dev-server), [@docusaurus/core](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus) and [@docusaurus/preset-classic](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic). These dependencies need to be updated together.


Updates `webpack-dev-server` from 3.11.2 to 5.2.4
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v3.11.2...v5.2.4)

Updates `@docusaurus/core` from 2.0.0-beta.4 to 3.10.1
- [Release notes](https://github.com/facebook/docusaurus/releases)
- [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG-v2.md)
- [Commits](https://github.com/facebook/docusaurus/commits/v3.10.1/packages/docusaurus)

Updates `@docusaurus/preset-classic` from 2.0.0-beta.4 to 3.10.1
- [Release notes](https://github.com/facebook/docusaurus/releases)
- [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG-v2.md)
- [Commits](https://github.com/facebook/docusaurus/commits/v3.10.1/packages/docusaurus-preset-classic)

---
updated-dependencies:
- dependency-name: webpack-dev-server
  dependency-version: 5.2.4
  dependency-type: indirect
- dependency-name: "@docusaurus/core"
  dependency-version: 3.10.1
  dependency-type: direct:production
- dependency-name: "@docusaurus/preset-classic"
  dependency-version: 3.10.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 19, 2026
@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages Bot commented May 19, 2026 •
edited
Loading

Deploying docs with  Cloudflare Pages  Cloudflare Pages

Latest commit: 485b87e
Status:🚫  Build failed.

View logs

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 19, 2026
@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 19, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​docusaurus/​preset-classic@​2.0.0-beta.4 ⏵ 3.10.19910070 +799100
Updated@​docusaurus/​core@​2.0.0-beta.4 ⏵ 3.10.198 +110076 +299100

View full report

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 19, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm entities is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: package-lock.json → npm/@docusaurus/core@3.10.1 → npm/@docusaurus/preset-classic@3.10.1 → npm/@easyops-cn/docusaurus-search-local@0.19.1 → npm/entities@4.5.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@4.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm entities is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: package-lock.json → npm/@docusaurus/preset-classic@3.10.1 → npm/@easyops-cn/docusaurus-search-local@0.19.1 → npm/entities@6.0.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@6.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@ignoramous ignoramous requested a review from Copilot May 19, 2026 21:07
Copilot AI reviewed May 19, 2026
View reviewed changes
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR bumps Docusaurus from 2 beta to 3.10.1, which also updates the transitive webpack-dev-server dependency for the docs site.

Changes:

  • Updates @docusaurus/core to ^3.10.1.
  • Updates @docusaurus/preset-classic to ^3.10.1.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread package.json
Comment on lines +17 to +18
"@docusaurus/core": "^3.10.1",
"@docusaurus/preset-classic": "^3.10.1",
Comment thread package.json
Comment on lines +17 to +18
"@docusaurus/core": "^3.10.1",
"@docusaurus/preset-classic": "^3.10.1",
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant