Track the deepmerge advisory that has no patched release

Aperta
  • Qualcosa non va?
#396 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
1/5
Tempo stimato
Meno di un'ora
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
github-actions, typescript
Ambito
devops

Direzione di ricerca

Start by reading the dependency declarations and lockfile entries for deepmerge, @svgr/plugin-svgo, and the Docusaurus packages, then check whether a release newer than 4.3.1 is available. When one is available, update the dependency and run npm audit; done means the advisory is gone without downgrading Docusaurus. Until then, the issue says to leave the dependency unchanged.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Medium Priority Security vulnerabilities

Summary

After the November pin pass (#392), npm audit has no high or moderate findings. The remaining low is one advisory, repeated through the SVGR chain:

  • deepmerge >= 4.2.0 (GHSA-gcqx-w48m-w2h4)
  • Pulled in by @svgr/plugin-svgo, then @svgr/webpack, @docusaurus/plugin-svgr, and @docusaurus/preset-classic
  • Newest 4.x release is 4.3.1, which is still inside the range
  • @svgr/plugin-svgo requires ^4.3.1, so an override to an older 4.x is outside the version that package asks for

npm audit fix --force wants to downgrade @docusaurus/preset-classic to 3.6.3. Do not do that.

This is separate from #339, which is the braces advisory. #338 should keep failing only on high and critical, so this low must not turn the build red. It still needs a place to be revisited.

What to change

  • Leave the dependency where it is.
  • When a deepmerge release newer than 4.3.1 is published, bump it and confirm npm audit no longer reports GHSA-gcqx-w48m-w2h4.
  • Until then, do not allow-list it by downgrading Docusaurus.

Acceptance

  • The issue stays open until a patched deepmerge exists
  • No pull request downgrades Docusaurus to clear this one low
Lingua principale
TypeScript
Stelle
13
Fork
24
Merge medio
3g 1h
PR unite (30g)
34

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di IntersectMBO/developer-experience

Tutte le issue di IntersectMBO/developer-experience

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.