Security Updates: June 2026

[codedbychavez]

Describe the purpose of your pull request

• Security updates for June 2026

Related issues (only if applicable)

• Provide links to issues relating to this pull request.

How to test? (only if applicable)

• What part of the application was affected by the changes? What should be tested?

Requirement checklist

• I have validated my changes on a test/local environment.
• I have tested that the code snippets I added work. (Leave unchecked if there are no new code snippets.)
• I have added my changes to the V1 and V2 documentations.

[cloudflare-workers-and-pages]

Deploying configcat-docs with    Cloudflare Pages

Latest commit:	46fb106
Status:	✅  Deploy successful!
Preview URL:	https://dcfcb726.docs-xmy.pages.dev
Branch Preview URL:	https://security-updates-june-2026.docs-xmy.pages.dev

View logs

[adams85]

npm audit still indicate a lot of vulnerabilities.

We could attempt to fix at least the high severity issues by pinning the problematic transitive dependencies:

  "overrides": {
    "lodash": "^4.18.1",
    "serialize-javascript": "^7.0.5"
  },

Of course, only if this doesn't break the project. (If npm start and npm build work, it will likely be ok.)

accidentally approved, sorry

[codedbychavez]

Hi @adams85

Adding the overrides worked! Thank you 🙏

You can have another look.

[adams85]

Thank you, all looks good now (at least, as far as it's possible 😄).

(The reminder applies here too: let's not forget to remove the overrides once they update the top-level dependency, docusaurus, to reference the patched version.)

[codedbychavez]

Thank you, all looks good now (at least, as far as it's possible 😄).

(The reminder applies here too: let's not forget to remove the overrides once they update the top-level dependency, docusaurus, to reference the patched version.)

Sure, no problem! 📝

@adams85 It seems like the validate_documentExpected — Waiting for status to be reported check is stuck and I can't merge 🤔

[adams85]

Looks unrelated to the changes, probably it's just some issue with GitHub.

I'll bypass the checks and merge the PR.