You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mahout.apache.org by "ryankert01 (via GitHub)" <gi...@apache.org> on 2026/06/05 15:22:20 UTC
[PR] fix(website): resolve npm audit vulnerabilities and upgrade Docusaurus to 3.10.1 [mahout]
ryankert01 opened a new pull request, #1375:
URL: https://github.com/apache/mahout/pull/1375
## Summary
Fixes all 22 `npm audit` findings (1 high, 21 moderate) in the website and upgrades Docusaurus from 3.9.2 to 3.10.1.
### Vulnerabilities fixed via npm `overrides`
Both issues are transitive deps that even the latest Docusaurus (3.10.1) hasn't bumped upstream yet, so `overrides` are used to force the patched versions:
| Package | Vulnerable | Fixed | Advisories |
|---|---|---|---|
| `serialize-javascript` (via copy-webpack-plugin / css-minimizer-webpack-plugin) | 6.0.2 | ^7.0.5 | [GHSA-5c6j-r48x-rmvq](https://github.com/advisories/GHSA-5c6j-r48x-rmvq) (RCE, high), [GHSA-qj8w-gfj5-8c6v](https://github.com/advisories/GHSA-qj8w-gfj5-8c6v) (DoS) |
| `uuid` (via webpack-dev-server → sockjs) | 8.3.2 | ^11.1.1 | [GHSA-w5hq-g745-h8pq](https://github.com/advisories/GHSA-w5hq-g745-h8pq) (moderate) |
Note: `npm audit fix --force` was not used as it would have *downgraded* Docusaurus to 3.5.2. uuid is pinned to v11 (not latest v14) because sockjs loads it via CommonJS, which newer uuid majors dropped.
### Docusaurus 3.9.2 → 3.10.1
- All `@docusaurus/*` packages bumped to 3.10.1
- Added `@docusaurus/faster`, now required by the existing `future: { v4: true }` config flag in 3.10 (builds use the Rspack bundler)
The overrides can be removed once Docusaurus bumps to copy-webpack-plugin@14 / css-minimizer-webpack-plugin@8 and sockjs updates uuid.
## Test plan
- [x] `npm audit` → 0 vulnerabilities
- [x] `npm run typecheck` → passes
- [x] `npm run build` → succeeds (pre-existing broken-link warnings on `/docs/0.4/download/quickstart` are unrelated content issues)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@mahout.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(website): resolve npm audit vulnerabilities and upgrade Docusaurus to 3.10.1 [mahout]
Posted by "ryankert01 (via GitHub)" <gi...@apache.org>.
ryankert01 merged PR #1375:
URL: https://github.com/apache/mahout/pull/1375
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@mahout.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(website): resolve npm audit vulnerabilities and upgrade Docusaurus to 3.10.1 [mahout]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #1375:
URL: https://github.com/apache/mahout/pull/1375#discussion_r3363644760
##########
website/package.json:
##########
@@ -18,25 +18,32 @@
"version": "docusaurus docs:version"
},
"dependencies": {
- "@docusaurus/core": "3.9.2",
- "@docusaurus/preset-classic": "3.9.2",
- "@docusaurus/plugin-client-redirects": "3.9.2",
+ "@docusaurus/core": "3.10.1",
+ "@docusaurus/faster": "^3.10.1",
Review Comment:
`@docusaurus/faster` is the only Docusaurus package using a semver range (`^3.10.1`) while the rest are pinned to `3.10.1`. This can lead to accidental version skew (e.g., `@docusaurus/faster` updating to 3.10.x/3.11.x while core stays at 3.10.1), which is a common source of hard-to-debug bundler/tooling issues. Pin it to the same exact version as the other `@docusaurus/*` packages.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@mahout.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(website): resolve npm audit vulnerabilities and upgrade Docusaurus to 3.10.1 [mahout]
Posted by "ryankert01 (via GitHub)" <gi...@apache.org>.
ryankert01 commented on code in PR #1375:
URL: https://github.com/apache/mahout/pull/1375#discussion_r3363671344
##########
website/package.json:
##########
@@ -18,25 +18,32 @@
"version": "docusaurus docs:version"
},
"dependencies": {
- "@docusaurus/core": "3.9.2",
- "@docusaurus/preset-classic": "3.9.2",
- "@docusaurus/plugin-client-redirects": "3.9.2",
+ "@docusaurus/core": "3.10.1",
+ "@docusaurus/faster": "^3.10.1",
Review Comment:
Good catch — fixed in 08780e681, `@docusaurus/faster` is now pinned to `3.10.1` like the rest.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@mahout.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org