Skip to content

Commit 4218f16

Browse files
Piotr Brzyskimeta-codesync[bot]
authored andcommitted
{Documentation} Fix Dependabot ws vulnerability
Summary: Fixes T276432705 GitHub Actions Dependabot test failure on main caused by D109036358. Root cause: D109036358 upgraded Docusaurus to 3.10.1 which depends on webpack-bundle-analyzer ^4.10.2 -> ws ^7.3.1 (vulnerable 7.5.10) and webpack-dev-server -> ws ^8.18.0 (vulnerable 8.19.0). Dependabot security update for ws failed with security_update_not_possible because latest resolvable versions were vulnerable. Fix: - Add resolutions for "ws": "^8.21.0" and "webpack-bundle-analyzer": "^5.3.0" in website/package.json to force safe ws version across all dependencies. webpack-bundle-analyzer 5.x uses ws ^8.19.0 which resolves to 8.21.0. - Run yarn install to update yarn.lock: ws now at 8.21.0 (safe), webpack-bundle-analyzer at 5.3.0, removes ws 7.x entirely. - Verified with yarn build succeeding with no warnings. ___ Differential Revision: D109146663 fbshipit-source-id: 128caa9a1b91ee06abda82f7654f57c5615ec303
1 parent d71d8dd commit 4218f16

2 files changed

Lines changed: 34 additions & 51 deletions

File tree

website/package.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,8 @@
9595
"postcss": "^8.5.10",
9696
"serialize-javascript": "^7.0.5",
9797
"svgo": "^3.3.3",
98-
"uuid": "^14.0.0"
98+
"uuid": "^14.0.0",
99+
"ws": "^8.21.0",
100+
"webpack-bundle-analyzer": "^5.3.0"
99101
}
100102
}

website/yarn.lock

Lines changed: 31 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -1754,10 +1754,10 @@
17541754
resolved "https://registry.yarnpkg.com/@csstools/utilities/-/utilities-2.0.0.tgz#f7ff0fee38c9ffb5646d47b6906e0bc8868bde60"
17551755
integrity sha512-5VdOr0Z71u+Yp3ozOx8T11N703wIFGVRgOWbOZMKgglPJsWA54MRIoMNVMa7shUToIhx5J8vX4sOZgD2XiihiQ==
17561756

1757-
"@discoveryjs/json-ext@0.5.7":
1758-
version "0.5.7"
1759-
resolved "https://registry.yarnpkg.com/@discoveryjs/json-ext/-/json-ext-0.5.7.tgz#1d572bfbbe14b7704e0ba0f39b74815b84870d70"
1760-
integrity sha512-dBVuXR082gk3jsFp7Rd/JI4kytwGHecnCoTtXFb7DB6CNHp4rg5k1bhg0nWdLGLnOV71lmDzGQaLMy8iPLY0pw==
1757+
"@discoveryjs/json-ext@^0.6.3":
1758+
version "0.6.3"
1759+
resolved "https://registry.yarnpkg.com/@discoveryjs/json-ext/-/json-ext-0.6.3.tgz#f13c7c205915eb91ae54c557f5e92bddd8be0e83"
1760+
integrity sha512-4B4OijXeVNOPZlYA2oEwWOTkzyltLao+xbotHQeqN++Rv27Y6s818+n2Qkp8q+Fxhn0t/5lA5X1Mxktud8eayQ==
17611761

17621762
"@docsearch/core@4.6.3":
17631763
version "4.6.3"
@@ -4698,6 +4698,11 @@ commander@^10.0.0:
46984698
resolved "https://registry.yarnpkg.com/commander/-/commander-10.0.1.tgz#881ee46b4f77d1c1dccc5823433aa39b022cbe06"
46994699
integrity sha512-y4Mg2tXshplEbSGzx7amzPwKKOCGuoSRP/CjEdwwk0FOGlUbq6lKuoyDZTNZkmxHdJtp54hdfY/JUrdL7Xfdug==
47004700

4701+
commander@^14.0.2:
4702+
version "14.0.3"
4703+
resolved "https://registry.yarnpkg.com/commander/-/commander-14.0.3.tgz#425d79b48f9af82fcd9e4fc1ea8af6c5ec07bbc2"
4704+
integrity sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==
4705+
47014706
commander@^2.20.0:
47024707
version "2.20.3"
47034708
resolved "https://registry.yarnpkg.com/commander/-/commander-2.20.3.tgz#fd485e84c03eb4881c20722ba48035e8531aeb33"
@@ -5440,11 +5445,6 @@ dayjs@^1.11.19:
54405445
resolved "https://registry.yarnpkg.com/dayjs/-/dayjs-1.11.20.tgz#88d919fd639dc991415da5f4cb6f1b6650811938"
54415446
integrity sha512-YbwwqR/uYpeoP4pu043q+LTDLFBLApUP6VxRihdfNTqu4ubqMlGDLd6ErXhEgsyvY0K6nCs7nggYumAN+9uEuQ==
54425447

5443-
debounce@^1.2.1:
5444-
version "1.2.1"
5445-
resolved "https://registry.yarnpkg.com/debounce/-/debounce-1.2.1.tgz#38881d8f4166a5c5848020c11827b834bcb3e0a5"
5446-
integrity sha512-XRRe6Glud4rd/ZGQfiV1ruXSfbvfJedlV9Y6zOlP+2K04vBYiJEte6stfFkCP03aMnY5tsipamumUjL14fofug==
5447-
54485448
debug@2.6.9:
54495449
version "2.6.9"
54505450
resolved "https://registry.yarnpkg.com/debug/-/debug-2.6.9.tgz#5d128515df134ff327e90a4c93f4e077a536341f"
@@ -5778,11 +5778,6 @@ dunder-proto@^1.0.0, dunder-proto@^1.0.1:
57785778
es-errors "^1.3.0"
57795779
gopd "^1.2.0"
57805780

5781-
duplexer@^0.1.2:
5782-
version "0.1.2"
5783-
resolved "https://registry.yarnpkg.com/duplexer/-/duplexer-0.1.2.tgz#3abe43aef3835f8ae077d136ddce0f276b0400e6"
5784-
integrity sha512-jtD6YG370ZCIi/9GTaJKQxWTZD045+4R4hTk/x1UyoqadyJ9x9CgSi1RlVDQF8U2sxLLSnFkCaMihqljHIWgMg==
5785-
57865781
eastasianwidth@^0.2.0:
57875782
version "0.2.0"
57885783
resolved "https://registry.yarnpkg.com/eastasianwidth/-/eastasianwidth-0.2.0.tgz#696ce2ec0aa0e6ea93a397ffcf24aa7840c827cb"
@@ -6906,13 +6901,6 @@ gray-matter@^4.0.3:
69066901
section-matter "^1.0.0"
69076902
strip-bom-string "^1.0.0"
69086903

6909-
gzip-size@^6.0.0:
6910-
version "6.0.0"
6911-
resolved "https://registry.yarnpkg.com/gzip-size/-/gzip-size-6.0.0.tgz#065367fd50c239c0671cbcbad5be3e2eeb10e462"
6912-
integrity sha512-ax7ZYomf6jqPTQ4+XCpUGyXKHk5WweS+e05MBO4/y3WJ5RkmPXNKvX+bx1behVILVwr6JSQvZAku021CHPXG3Q==
6913-
dependencies:
6914-
duplexer "^0.1.2"
6915-
69166904
hachure-fill@^0.5.2:
69176905
version "0.5.2"
69186906
resolved "https://registry.yarnpkg.com/hachure-fill/-/hachure-fill-0.5.2.tgz#d19bc4cc8750a5962b47fb1300557a85fcf934cc"
@@ -7279,10 +7267,10 @@ htm@^3.1.1:
72797267
resolved "https://registry.yarnpkg.com/htm/-/htm-3.1.1.tgz#49266582be0dc66ed2235d5ea892307cc0c24b78"
72807268
integrity sha512-983Vyg8NwUE7JkZ6NmOqpCZ+sh1bKv2iYTlUkzlWmA5JD2acKoxd4KVxbMmxX/85mtfdnDmTFoNKcg5DGAvxNQ==
72817269

7282-
html-escaper@^2.0.2:
7283-
version "2.0.2"
7284-
resolved "https://registry.yarnpkg.com/html-escaper/-/html-escaper-2.0.2.tgz#dfd60027da36a36dfcbe236262c00a5822681453"
7285-
integrity sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==
7270+
html-escaper@^3.0.3:
7271+
version "3.0.3"
7272+
resolved "https://registry.yarnpkg.com/html-escaper/-/html-escaper-3.0.3.tgz#4d336674652beb1dcbc29ef6b6ba7f6be6fdfed6"
7273+
integrity sha512-RuMffC89BOWQoY0WKGpIhn5gX3iI54O6nRA0yC124NYVtzjmFWBIiFd8M0x+ZdX0P9R4lADg1mgP8C7PxGOWuQ==
72867274

72877275
html-minifier-terser@^6.0.2:
72887276
version "6.1.0"
@@ -11831,10 +11819,10 @@ signal-exit@^4.0.1:
1183111819
resolved "https://registry.yarnpkg.com/signal-exit/-/signal-exit-4.1.0.tgz#952188c1cbd546070e2dd20d0f41c0ae0530cb04"
1183211820
integrity sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==
1183311821

11834-
sirv@^2.0.3:
11835-
version "2.0.4"
11836-
resolved "https://registry.yarnpkg.com/sirv/-/sirv-2.0.4.tgz#5dd9a725c578e34e449f332703eb2a74e46a29b0"
11837-
integrity sha512-94Bdh3cC2PKrbgSOUqTiGPWVZeSiXfKOVZNJniWoqrWrRkB1CJzBU3NEbiTsPcYy1lDsANA/THzS+9WBiy5nfQ==
11822+
sirv@^3.0.2:
11823+
version "3.0.2"
11824+
resolved "https://registry.yarnpkg.com/sirv/-/sirv-3.0.2.tgz#f775fccf10e22a40832684848d636346f41cd970"
11825+
integrity sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g==
1183811826
dependencies:
1183911827
"@polka/url" "^1.0.0-next.24"
1184011828
mrmime "^2.0.0"
@@ -13015,23 +13003,21 @@ webidl-conversions@^3.0.0:
1301513003
resolved "https://registry.yarnpkg.com/webidl-conversions/-/webidl-conversions-3.0.1.tgz#24534275e2a7bc6be7bc86611cc16ae0a5654871"
1301613004
integrity sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==
1301713005

13018-
webpack-bundle-analyzer@^4.10.2:
13019-
version "4.10.2"
13020-
resolved "https://registry.yarnpkg.com/webpack-bundle-analyzer/-/webpack-bundle-analyzer-4.10.2.tgz#633af2862c213730be3dbdf40456db171b60d5bd"
13021-
integrity sha512-vJptkMm9pk5si4Bv922ZbKLV8UTT4zib4FPgXMhgzUny0bfDDkLXAVQs3ly3fS4/TN9ROFtb0NFrm04UXFE/Vw==
13006+
webpack-bundle-analyzer@^4.10.2, webpack-bundle-analyzer@^5.3.0:
13007+
version "5.3.0"
13008+
resolved "https://registry.yarnpkg.com/webpack-bundle-analyzer/-/webpack-bundle-analyzer-5.3.0.tgz#ca289e08f2f5e39964a9988c38ff3090559392bf"
13009+
integrity sha512-PEhAoqiJ+47d0uLMx/+zo5XOvaU+Vk6N2ZLht7H3n09QLy/fhyvqGNwjdRUHJDgMN8crBR2ZwVHkIswT3Xuawg==
1302213010
dependencies:
13023-
"@discoveryjs/json-ext" "0.5.7"
13011+
"@discoveryjs/json-ext" "^0.6.3"
1302413012
acorn "^8.0.4"
1302513013
acorn-walk "^8.0.0"
13026-
commander "^7.2.0"
13027-
debounce "^1.2.1"
13028-
escape-string-regexp "^4.0.0"
13029-
gzip-size "^6.0.0"
13030-
html-escaper "^2.0.2"
13014+
commander "^14.0.2"
13015+
escape-string-regexp "^5.0.0"
13016+
html-escaper "^3.0.3"
1303113017
opener "^1.5.2"
1303213018
picocolors "^1.0.0"
13033-
sirv "^2.0.3"
13034-
ws "^7.3.1"
13019+
sirv "^3.0.2"
13020+
ws "^8.19.0"
1303513021

1303613022
webpack-dev-middleware@^7.4.2:
1303713023
version "7.4.5"
@@ -13295,15 +13281,10 @@ write-file-atomic@^5.0.1:
1329513281
imurmurhash "^0.1.4"
1329613282
signal-exit "^4.0.1"
1329713283

13298-
ws@^7.3.1:
13299-
version "7.5.10"
13300-
resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.10.tgz#58b5c20dc281633f6c19113f39b349bd8bd558d9"
13301-
integrity sha512-+dbF1tHwZpXcbOJdVOkzLDxZP1ailvSxM6ZweXTegylPny803bFhA+vqBYw4s31NSAk4S2Qz+AKXK9a4wkdjcQ==
13302-
13303-
ws@^8.18.0:
13304-
version "8.19.0"
13305-
resolved "https://registry.yarnpkg.com/ws/-/ws-8.19.0.tgz#ddc2bdfa5b9ad860204f5a72a4863a8895fd8c8b"
13306-
integrity sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==
13284+
ws@^8.18.0, ws@^8.19.0, ws@^8.21.0:
13285+
version "8.21.0"
13286+
resolved "https://registry.yarnpkg.com/ws/-/ws-8.21.0.tgz#012e413fc07429945121b0c153158c4343086951"
13287+
integrity sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==
1330713288

1330813289
wsl-utils@^0.1.0:
1330913290
version "0.1.0"

0 commit comments

Comments
 (0)