Refresh documentation dependencies with open security advisories

Open
  • Is something wrong?
#7,636 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
56/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
github, node.js
Domain
documentation, security

Research direction

Start with docs/package.json and docs/yarn.lock, then inspect the Dependabot alerts using the provided gh command. Check which patched versions of tinypool, katex, and uuid fit the documentation tooling, and investigate whether deepmerge has a compatible fix or replacement. Done means updating the dependency graph, recording any upstream blocker, and passing the frozen-lockfile install and production build with supported Node and Yarn versions.

Written by the indexing model from the issue text.

Description

bug dependencies javascript P2

Summary

GitHub currently reports five open Dependabot alerts for transitive dependencies in docs/yarn.lock, including two critical advisories against tinypool 1.1.1. The documentation dependency graph should use patched releases where available so contributors can install its build tooling without these outstanding alerts.

Reproduction

Inspect the open repository alerts with:

gh api repos/thomhurst/TUnit/dependabot/alerts --jq '.[] | select(.state == "open") | {number, dependency, security_advisory, security_vulnerability}'

The affected lockfile is docs/yarn.lock at 555b85d067. Searches of open and closed issues and open PRs for the package names found no matching tracking item.

Expected and actual

Expected: the documentation dependency graph resolves patched package versions where available, and any remaining upstream blocker is recorded.

Actual, as reported by the current alerts on November 5, 2026:

Package Locked version Alert Patched version reported by GitHub
tinypool 1.1.1 GHSA-85c8-ppgw-ccpr, alert 151 2.1.2
tinypool 1.1.1 GHSA-5gmw-xhrv-c9v3, alert 152 2.1.1
katex 0.16.47 GHSA-238p-pmpm-9mq7, alert 158 0.18.2
deepmerge 4.3.1 GHSA-gcqx-w48m-w2h4, alert 172 None listed
uuid 8.3.2 GHSA-w5hq-g745-h8pq, alert 99 11.1.1

Acceptance criteria

  • Update docs/package.json and docs/yarn.lock as needed to resolve patched versions for tinypool, katex, and uuid, preserving compatibility with the documentation tooling.
  • Investigate deepmerge; record the upstream blocker if no compatible patched release or safe dependency replacement is available.
  • Validate a frozen-lockfile installation and the documentation production build with the supported Node/Yarn versions.
  • Recheck the repository Dependabot alerts after the updated graph reaches main; document any remaining alert and its reason.

Environment

Repository main, Yarn v1 lockfile, @docusaurus/core 3.10.2. Discovered from the push warning while implementing #7378; this concerns documentation tooling rather than the .NET packages.

Please refresh the documentation dependency graph to address these alerts and record any package that still needs an upstream fix.

Dominant language
C#
Stars
4k
Forks
139
Avg merge
7h 16m
Merged PRs (30d)
355

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from thomhurst/TUnit

All issues in thomhurst/TUnit

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.