Skip to content

chore: resolve open dependabot security alerts - #997

Open
jonathannorris wants to merge 1 commit into
mainfrom
chore/dependabot-alerts
Open

chore: resolve open dependabot security alerts#997
jonathannorris wants to merge 1 commit into
mainfrom
chore/dependabot-alerts

Conversation

@jonathannorris

Copy link
Copy Markdown
Member

Summary

  • Resolved 15 open Dependabot security alerts by bumping vulnerable transitive dependencies via yarn resolutions

Dependabot Alerts Resolved

Alert Package Severity Fix
#241 postcss high Bumped resolution to ^8.5.23
#251 postcss medium Bumped resolution to ^8.5.23
#243 brace-expansion high Bumped resolution to ^2.1.4
#248 brace-expansion high Bumped resolution to ^1.1.18
#249 brace-expansion high Bumped resolution to ^1.1.18
#250 brace-expansion high Bumped resolution to ^2.1.4
#244 ip-address medium Added resolution ^10.3.1
#245 ip-address medium Added resolution ^10.3.1
#246 ip-address high Added resolution ^10.3.1
#247 fast-uri high Bumped resolution to ^3.1.5
#252 js-yaml high Bumped resolution to ^4.3.1
#253 js-yaml high Bumped resolution to ^3.15.1
#254 dompurify medium Bumped resolution to ^3.4.13
#257 nanoid high Added resolution ^3.3.17
#258 nanoid high Added resolution ^3.3.17

All packages are transitive dependencies (via Docusaurus/webpack tooling); fixed using yarn resolutions in package.json. Verified yarn build completes successfully with the updated dependency tree.

- postcss ^8.5.12 -> ^8.5.23 (high, alerts #241, #251)
- brace-expansion resolutions bumped to ^1.1.18 / ^2.1.4 (high, alerts #243, #248, #249, #250)
- ip-address added resolution ^10.3.1 (high/medium, alerts #244, #245, #246)
- fast-uri ^3.1.4 -> ^3.1.5 (high, alert #247)
- js-yaml resolutions bumped to ^3.15.1 / ^4.3.1 (high, alerts #252, #253)
- dompurify ^3.4.12 -> ^3.4.13 (medium, alert #254)
- nanoid added resolution ^3.3.17 (high, alerts #257, #258)
Copilot AI lite review requested due to automatic review settings August 12, 2026 13:27

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Resolves open Dependabot security alerts by bumping vulnerable transitive dependencies used by the Docusaurus/webpack toolchain via Yarn resolutions, and updating the lockfile to match the new resolved versions.

Changes:

  • Updated package.json resolutions for postcss, brace-expansion, ip-address, fast-uri, js-yaml, dompurify, and nanoid.
  • Regenerated yarn.lock to reflect the new dependency versions and checksums.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File Description
package.json Updates Yarn resolutions to force patched versions of vulnerable transitive dependencies.
yarn.lock Updates resolved versions/checksums so installs are consistent with the new resolutions.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying devcycle-docs with  Cloudflare Pages  Cloudflare Pages

Latest commit: fd177d4
Status: ✅  Deploy successful!
Preview URL: https://1363be2e.devcycle-docs.pages.dev
Branch Preview URL: https://chore-dependabot-alerts.devcycle-docs.pages.dev

View logs

@jonathannorris
jonathannorris enabled auto-merge (squash) August 12, 2026 13:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants