Repository navigation
Docs site dependencies carry open Dependabot alerts #330
Description
Five Dependabot alerts are open against the docs site's root package-lock.json. All are transitive dependencies of @docusaurus/core 3.10.2. None ship in a runtime image.
| Alert | Package | Severity | Installed | Patched |
|---|---|---|---|---|
| #92, #93 | tinypool (GHSA-85c8-ppgw-ccpr, GHSA-5gmw-xhrv-c9v3) |
Critical | 1.1.1 | 2.1.2 |
| #91 | http-cache-semantics (GHSA-ch52-4w7c-c8xp) |
High | 4.2.0 | 4.3.0 |
| #90 | braces (GHSA-vfj7-8cjw-p6xm) |
High | 3.0.3 | none |
| #94 | postcss-selector-parser (GHSA-rj75-hqrm-r3gf) |
Medium | 6.1.4, 7.1.5 | 7.1.6 |
Docusaurus pins tinypool to ^1.0.2 and postcss-discard-unused pins postcss-selector-parser to ^6. Both need an npm override. braces has no patched release yet.
Activity
fix(docs): patch tinypool, postcss-selector-parser and http-cache-sem…
indigo423 commentedon Oct 15, 2026
Fixed in #331 (alerts #91–#94). Alert #90 (
braces, no patched release) dismissed as tolerable risk: build-time only, inputs are the repo's own glob patterns. Zero open Dependabot alerts remain.fix(docs): patch webpack-dev-middleware and record accepted braces ri…
chore(security): accept deepmerge advisory with no patched release (#367