Track the deepmerge advisory that has no patched release

Aberta
  • Algo errado?
#396 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 2 dias

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
1/5
Tempo estimado
Menos de uma hora
Facilidade para iniciantes
45/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
github-actions, typescript
Domínio
devops

Direção de pesquisa

Start by reading the dependency declarations and lockfile entries for deepmerge, @svgr/plugin-svgo, and the Docusaurus packages, then check whether a release newer than 4.3.1 is available. When one is available, update the dependency and run npm audit; done means the advisory is gone without downgrading Docusaurus. Until then, the issue says to leave the dependency unchanged.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Medium Priority Security vulnerabilities

Summary

After the November pin pass (#392), npm audit has no high or moderate findings. The remaining low is one advisory, repeated through the SVGR chain:

  • deepmerge >= 4.2.0 (GHSA-gcqx-w48m-w2h4)
  • Pulled in by @svgr/plugin-svgo, then @svgr/webpack, @docusaurus/plugin-svgr, and @docusaurus/preset-classic
  • Newest 4.x release is 4.3.1, which is still inside the range
  • @svgr/plugin-svgo requires ^4.3.1, so an override to an older 4.x is outside the version that package asks for

npm audit fix --force wants to downgrade @docusaurus/preset-classic to 3.6.3. Do not do that.

This is separate from #339, which is the braces advisory. #338 should keep failing only on high and critical, so this low must not turn the build red. It still needs a place to be revisited.

What to change

  • Leave the dependency where it is.
  • When a deepmerge release newer than 4.3.1 is published, bump it and confirm npm audit no longer reports GHSA-gcqx-w48m-w2h4.
  • Until then, do not allow-list it by downgrading Docusaurus.

Acceptance

  • The issue stays open until a patched deepmerge exists
  • No pull request downgrades Docusaurus to clear this one low
Linguagem predominante
TypeScript
Estrelas
13
Forks
24
Merge médio
3d 1h
PRs com merge (30d)
34

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de IntersectMBO/developer-experience

Todas as issues de IntersectMBO/developer-experience

Issues semelhantes

Mais issues de TypeScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.