Repository navigation
fix(deps): bump tinypool and serialize-javascript to resolve Dependabot alerts - #163
Merged
Merged
Conversation
…ot alerts Resolves 3 of the 4 open Dependabot alerts, plus other advisories that npm audit reports, by updating transitive dependencies: - tinypool 1.1.1 -> 2.2.0 via a new npm override (@docusaurus/core pins ^1.0.2, so the fix is outside its range) — GHSA for Prototype Pollution to RCE in worker options and run() options (critical, alerts #147, #148). tinypool 2.x only drops Node 18, which Docusaurus 3.10 already requires (>=20). Verified with a multi-threaded SSG build. - serialize-javascript 7.0.5 -> 7.1.3 (override bumped) — XSS via unescaped </script (alert #155) - qs 6.16.0 -> 6.17.1 (override bumped) — GHSA-6pq8-jhm2-2vcw - npm audit fix (non-breaking, lockfile only): shell-quote, proxy-addr, undici, body-parser, express, compression, follow-redirects, joi, image-size, svgo, brace-expansion, source-map-js, launch-editor, fast-uri and others The deepmerge alert (GHSA-gcqx-w48m-w2h4, alert #156, low) has no patched release; 4.3.1 is the latest version. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ol-serialize-javascript # Conflicts: # package-lock.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves 3 of the 4 open Dependabot alerts, both criticals included.
Also from
npm audit:npm audit fix, lockfile only)Notes
@docusaurus/corepins^1.0.2, so the fix needs an override to 2.x. The only breaking change in 2.x is dropping Node 18, and Docusaurus 3.10 already requires Node >= 20 (CI uses 22). I checked theTinypoolconstructor options andprocess.__tinypool_state__that Docusaurus relies on; both are unchanged.@svgr/plugin-svgoand only runs at build time on our own SVGs, so the alert can be dismissed as "no fix available / not exploitable" until upstream ships a patch.npm auditshows 0 critical and 0 high findings. The remaining low and moderate findings are deepmerge and minimatch 3.x viaserve-handler. The minimatch fix is a major bump, and those two account for all of the cascading@docusaurus/*entries.Test plan
npm run buildwithDOCUSAURUS_SSG_WORKER_THREAD_COUNT=4, which forces the tinypool worker-pool SSG pathnpm run typecheck🤖 Generated with Claude Code