fix(website): patch 9 npm security advisories via overrides#474
Merged
Conversation
github-actions
Bot
added
size/XL
Contributor
PR Quality ReportCompared against base branch Coverage and tests
Compatibility
Performance smokePerformance smoke was skipped for this PR because no perf-sensitive paths changed. State
|
szibis
force-pushed
the
fix/website-npm-vulns
branch
from
July 22, 2026 09:17
120c83c to
5818bbd
Compare
github-actions
Bot
added
size/XL
Every alert is transitive. Adds package.json "overrides" pinning safe versions of js-yaml, ws, shell-quote, brace-expansion, webpack-dev-server, http-proxy-middleware, joi, body-parser and @babel/core, and regenerates the lockfile (also clearing newer dompurify/fast-uri/svgo advisories via patch bumps). js-yaml has no safe 3.x, and gray-matter (Docusaurus front matter) calls the removed js-yaml v3 safeLoad. So docusaurus.config.ts drives gray-matter with a js-yaml v4 load engine via markdown.parseFrontMatter. Verified: npm audit -> 0 vulnerabilities, tsc typecheck ok, site build succeeds. Docs-site only; no proxy runtime change.
szibis
force-pushed
the
fix/website-npm-vulns
branch
from
July 22, 2026 11:01
5818bbd to
cb9d315
Compare
github-actions
Bot
added
size/XL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Clears all 9 open Dependabot alerts in
website/(all transitive) usingpackage.jsonoverrides, plus a js-yaml v4 front-matter engine indocusaurus.config.ts.Alerts cleared
js-yaml(high, CVE-2026-59869) ·ws(high, CVE-2026-48779) ·shell-quote(high, CVE-2026-13311) ·brace-expansion(CVE-2026-13149) ·webpack-dev-server·http-proxy-middleware·joi·body-parser·@babel/core. Also resolves the correspondingwebsite/package-lock.jsonTrivy findings in the Security workflow.The js-yaml wrinkle
There is no non-vulnerable js-yaml 3.x, but
gray-matter(used by Docusaurus to parse front matter) calls js-yaml v3'ssafeLoad, removed in v4. So the override to js-yaml 4.3.0 is paired with amarkdown.parseFrontMattershim that drives gray-matter with a js-yaml v4loadengine. The two must ship together.Verification
npm audit→ found 0 vulnerabilities ✅npm run typecheck(tsc) → exit 0 ✅npm run build→ [SUCCESS] Generated static files ✅Carets pin every package to its current major (no risky major bumps).