Skip to content

[Snyk] Fix for 2 vulnerabilities #197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rramo012 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Fix for 2 vulnerabilities #197

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,26 +23,26 @@
"@algolia/client-search": ">= 4.9.1 < 6",
"@docsearch/css": "4.6.2",
"@docsearch/js": "4.6.2",
"@docusaurus/core": "^2.2.0",
"@docusaurus/core": "^3.10.2",
"@docusaurus/cssnano-preset": "2.2.0",
"@docusaurus/plugin-client-redirects": "2.2.0",
"@docusaurus/plugin-debug": "2.2.0",
"@docusaurus/plugin-google-analytics": "2.2.0",
"@docusaurus/plugin-google-gtag": "2.2.0",
"@docusaurus/plugin-sitemap": "2.2.0",
"@docusaurus/preset-classic": "2.2.0",
"@docusaurus/preset-classic": "3.10.2",

@claude claude Bot Jul 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Likely to break the build. This Snyk PR bumps @docusaurus/core and @docusaurus/preset-classic from 2.2.0 to 3.10.2 (a two-major-version jump), but the sibling Docusaurus packages on lines 27-35 (cssnano-preset, plugin-client-redirects, plugin-debug, plugin-google-analytics, plugin-google-gtag, plugin-sitemap, theme-classic, theme-search-algolia) are still pinned to 2.2.0. Docusaurus v3 requires all @docusaurus/* packages to be on the same major version — mixing v2 and v3 packages will likely cause resolution conflicts or runtime plugin errors.

In addition, Docusaurus v3 requires React 18+ as a peer dependency, but react/react-dom here remain at ^17.0.1 (line 48-49). docusaurus.config.js also does require('prism-react-renderer/themes/github'), which is a v1-only import path — prism-react-renderer v2 (pulled in transitively by Docusaurus 3) uses a different API (themes.github named export), so this will likely throw at build time.

Recommend against merging as-is. Either:

  1. Bump all @docusaurus/* packages to 3.10.2 together, upgrade react/react-dom to 18, and update prism-react-renderer usage/version, following the official v2→v3 migration guide, or
  2. Close this PR and address the two flagged vulnerabilities (brace-expansion, js-yaml) via a targeted yarn upgrade of just the vulnerable transitive packages (e.g. yarn resolutions) without touching the Docusaurus major version.

"@docusaurus/theme-classic": "2.2.0",
"@docusaurus/theme-search-algolia": "2.2.0",
"@fortawesome/fontawesome-svg-core": "^6.4.0",
"@fortawesome/free-regular-svg-icons": "^6.4.0",
"@fortawesome/free-solid-svg-icons": "^6.4.0",
"@fortawesome/react-fontawesome": "^0.2.0",
"@mdx-js/react": "^1.6.21",
"@redocly/cli": "^1.25.7",
"@redocly/cli": "^2.19.2",
"clsx": "^1.1.1",
"disqus-react": "^1.1.5",
"live-server": "^1.2.2",
"markdownlint-cli": "^0.31.1",
"markdownlint-cli": "^0.49.1",
"openmetal-docs": "file:",
"prism-react-renderer": "^1.2.1",
"react": "^17.0.1",
Expand Down
Loading
Loading