Track the deepmerge advisory that has no patched release
维护者通常 2 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 1/5
- 预计耗时
- 1 小时以内
- 新手友好度
- 45/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- github-actions, typescript
- 领域
- devops
调研方向
Start by reading the dependency declarations and lockfile entries for deepmerge, @svgr/plugin-svgo, and the Docusaurus packages, then check whether a release newer than 4.3.1 is available. When one is available, update the dependency and run npm audit; done means the advisory is gone without downgrading Docusaurus. Until then, the issue says to leave the dependency unchanged.
由索引模型根据 Issue 内容生成。
描述
Summary
After the November pin pass (#392), npm audit has no high or moderate findings. The remaining low is one advisory, repeated through the SVGR chain:
deepmerge>= 4.2.0(GHSA-gcqx-w48m-w2h4)- Pulled in by
@svgr/plugin-svgo, then@svgr/webpack,@docusaurus/plugin-svgr, and@docusaurus/preset-classic - Newest 4.x release is 4.3.1, which is still inside the range
@svgr/plugin-svgorequires^4.3.1, so an override to an older 4.x is outside the version that package asks for
npm audit fix --force wants to downgrade @docusaurus/preset-classic to 3.6.3. Do not do that.
This is separate from #339, which is the braces advisory. #338 should keep failing only on high and critical, so this low must not turn the build red. It still needs a place to be revisited.
What to change
- Leave the dependency where it is.
- When a
deepmergerelease newer than 4.3.1 is published, bump it and confirmnpm auditno longer reportsGHSA-gcqx-w48m-w2h4. - Until then, do not allow-list it by downgrading Docusaurus.
Acceptance
- The issue stays open until a patched
deepmergeexists - No pull request downgrades Docusaurus to clear this one low
- 主要语言
- TypeScript
- 星标
- 13
- 派生
- 24
- 平均合并
- 3 天 1 小时
- 30 天内合并 PR
- 34
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
IntersectMBO/developer-experience 的其他 Issue
-
documentation enhancement Low Priority
难度 1/5 1 小时以内 新手友好度 72/100
IntersectMBO/developer-experience#397 ·
维护者通常 2 天内回复
-
documentation
难度 2/5 1-3 小时 新手友好度 72/100
IntersectMBO/developer-experience#376 ·
维护者通常 2 天内回复
-
documentation pinned
难度 2/5 1-3 小时 新手友好度 90/100
IntersectMBO/developer-experience#363 ·
维护者通常 2 天内回复
-
documentation pinned
难度 2/5 1-3 小时 新手友好度 88/100
IntersectMBO/developer-experience#362 ·
维护者通常 2 天内回复
-
documentation pinned
难度 2/5 1-3 小时 新手友好度 90/100
IntersectMBO/developer-experience#360 ·
维护者通常 2 天内回复
查看 IntersectMBO/developer-experience 的全部 Issue
相似的 Issue
-
bug parity
难度 2/5 1-3 小时 新手友好度 70/100
WenyuChiou/agent-board#1489 ·
维护者通常 1 天内回复
-
area: bazaar bug complexity: medium
难度 2/5 1-3 小时 新手友好度 74/100
accensa/x402-facilitator-stellar#779 ·
维护者通常 1 天内回复
-
bug good first issue P4 size:S web-ui
难度 2/5 半天 新手友好度 85/100
josephfung/curia#2600 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 62/100
cloudflare/partykit#444 ·