Track the deepmerge advisory that has no patched release
維護者通常 2 天內回覆
還沒有人認領這個 Issue。
評估
- 難度
- 1/5
- 預估耗時
- 1 小時以內
- 新手友好度
- 45/100
- Issue 類型
- 缺陷
- 描述清晰度
- 描述清楚
- 活躍度
- 活躍
- 技術堆疊
- github-actions, typescript
- 領域
- devops
研究方向
Start by reading the dependency declarations and lockfile entries for deepmerge, @svgr/plugin-svgo, and the Docusaurus packages, then check whether a release newer than 4.3.1 is available. When one is available, update the dependency and run npm audit; done means the advisory is gone without downgrading Docusaurus. Until then, the issue says to leave the dependency unchanged.
由索引模型根據 Issue 內容生成。
描述
Summary
After the November pin pass (#392), npm audit has no high or moderate findings. The remaining low is one advisory, repeated through the SVGR chain:
deepmerge>= 4.2.0(GHSA-gcqx-w48m-w2h4)- Pulled in by
@svgr/plugin-svgo, then@svgr/webpack,@docusaurus/plugin-svgr, and@docusaurus/preset-classic - Newest 4.x release is 4.3.1, which is still inside the range
@svgr/plugin-svgorequires^4.3.1, so an override to an older 4.x is outside the version that package asks for
npm audit fix --force wants to downgrade @docusaurus/preset-classic to 3.6.3. Do not do that.
This is separate from #339, which is the braces advisory. #338 should keep failing only on high and critical, so this low must not turn the build red. It still needs a place to be revisited.
What to change
- Leave the dependency where it is.
- When a
deepmergerelease newer than 4.3.1 is published, bump it and confirmnpm auditno longer reportsGHSA-gcqx-w48m-w2h4. - Until then, do not allow-list it by downgrading Docusaurus.
Acceptance
- The issue stays open until a patched
deepmergeexists - No pull request downgrades Docusaurus to clear this one low
- 主要語言
- TypeScript
- 星號
- 13
- 分支
- 24
- 平均合併
- 3 天 1 小時
- 30 天內合併 PR
- 34
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
IntersectMBO/developer-experience 的其他 Issue
-
documentation enhancement Low Priority
難度 1/5 1 小時以內 新手友好度 72/100
IntersectMBO/developer-experience#397 ·
維護者通常 2 天內回覆
-
documentation
難度 2/5 1-3 小時 新手友好度 72/100
IntersectMBO/developer-experience#376 ·
維護者通常 2 天內回覆
-
documentation pinned
難度 2/5 1-3 小時 新手友好度 90/100
IntersectMBO/developer-experience#363 ·
維護者通常 2 天內回覆
-
documentation pinned
難度 2/5 1-3 小時 新手友好度 88/100
IntersectMBO/developer-experience#362 ·
維護者通常 2 天內回覆
-
documentation pinned
難度 2/5 1-3 小時 新手友好度 90/100
IntersectMBO/developer-experience#360 ·
維護者通常 2 天內回覆
查看 IntersectMBO/developer-experience 的全部 Issue
相似的 Issue
-
[analytics-core] getQueryParams does not decode `+` as space and truncates values containing `=`未關閉bug
難度 2/5 1-3 小時 新手友好度 82/100
amplitude/Amplitude-TypeScript#2179 · 1 則留言 ·
維護者通常 2 天內回覆
-
ci good first issue severity: low
難度 2/5 1-3 小時 新手友好度 68/100
TMHSDigital/GH-Arcade#111 ·
-
AsnIntegerConverter.toASN coerces strings with +value, rounding integers outside safe-integer range未關閉
難度 2/5 1-3 小時 新手友好度 78/100
PeculiarVentures/asn1-schema#189 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 72/100
維護者通常 4 天內回覆
-
難度 2/5 1-3 小時 新手友好度 82/100