fix: resolve open dependabot security alerts#1375
Merged
jonathannorris merged 4 commits intomainfrom Apr 27, 2026
Merged
Conversation
Bumps @docusaurus/* to 3.10.0 and sass to 1.99.0, which naturally pull in patched versions of node-forge (dropped entirely), on-headers, and immutable without explicit resolutions. Adds yarn resolutions for the remaining 23 vulnerable transitive packages whose upstream parents haven't released updates yet. Note: tsup alert 80 (DOM Clobbering) has no patched version upstream and is left unresolved. Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
✅ Deploy Preview for openfeature ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request updates several Docusaurus and Sass dependencies and introduces a resolutions block in package.json. The review feedback indicates that many of the specified versions do not exist on the public npm registry, which would result in failed dependency resolution and installation. Specifically, the versions for Docusaurus, Sass, and numerous packages within the new resolutions block need to be corrected to valid, existing versions.
The blanket js-yaml resolution to ^4.1.1 broke gray-matter@4.0.3, which calls yaml.safeLoad (a js-yaml v3 API removed in v4). Without the resolution, Yarn naturally installs both js-yaml@3.14.2 (for gray-matter, covering alert 114) and js-yaml@4.1.1 (for everything else, covering alert 113). Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
The blanket ajv resolution to ^8.18.0 broke @eslint/eslintrc@2.1.4, which uses internal ajv v6 APIs that don't exist in v8. Without the resolution, Yarn naturally installs both ajv@6.15.0 (for eslint, covering alert 140) and ajv@8.20.0 (for schema-utils@4, covering alert 141). Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
svgo@3.3.3 (the security-patched version) added a limit of 512 entity references to mitigate Billion Laughs attacks. The SVG had 1052 entity references, all of which were unnecessary 	 (tab) and (newline) characters encoded as XML numeric entities. Replacing them with their literal equivalents brings the count to 2 and unblocks the build. Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
jonathannorris
commented
Apr 27, 2026
beeme1mr
approved these changes
Apr 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@docusaurus/*to3.10.0andsassto1.99.0, which naturally pull in patched transitive versions (node-forgedropped entirely viawebpack-dev-server@5.2.3→selfsigned@5.5.0,on-headers@1.1.0viacompression@1.8.1,immutable@5.1.5viasass@1.99.0)resolutionsentries inpackage.jsonfor 21 remaining vulnerable transitive packages whose upstream parents haven't released fixestsupDOM Clobbering) has no patched version available upstream and is left unresolvedNotes
tsupDOM Clobbering,<=8.3.4) has no patched version available upstream.js-yamlandajveach have two independently vulnerable major version lines; blanket resolutions brokegray-matter(usesjs-yaml@^3) and@eslint/eslintrc(usesajv@^6). Both are resolved by letting Yarn install the patched versions of each major line side by side.