Skip to content

Commit 80d2097

Browse files
kongchen1992meta-codesync[bot]
authored andcommitted
{Website} Fix lodash-es security vulnerability by upgrading deps and Node to 22 (#341)
Summary: Pull Request resolved: #341 Dependabot fails to upgrade lodash-es to the safe version (4.18.1) because chevrotain@11.1.1 pins it to exactly 4.17.23. Changes: - Upgrade docusaurus-plugin-internaldocs-fb ^1.19.1 → ^1.19.3 (drops direct chevrotain dep, uses mermaid instead) - Add yarn resolution langium ^4.2.2 (uses chevrotain 12.0.0 which removed lodash-es entirely) - Upgrade Node 20 → 22 in publish-website.yml + package.json engines (chevrotain 12.0.0 requires Node ≥ 22) After this change, all lodash-es references in yarn.lock use ^ semver ranges, allowing Dependabot to upgrade to 4.18.1. Reviewed By: ryanfrawley Differential Revision: D102057545 fbshipit-source-id: 39c8438a3b7c1c85b032dfc4a60f514e251916ad
1 parent b953585 commit 80d2097

3 files changed

Lines changed: 68 additions & 419 deletions

File tree

.github/workflows/publish-website.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,10 @@ jobs:
2323
steps:
2424
- name: Checkout
2525
uses: actions/checkout@v4
26+
- name: Set up Node.js
27+
uses: actions/setup-node@v4
28+
with:
29+
node-version: '22'
2630
- name: Install dependencies
2731
run: |
2832
sudo apt-get install doxygen

website/package.json

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030
"@mdx-js/react": "^3.1.0",
3131
"@types/react": "^18.3.3",
3232
"clsx": "^2.1.1",
33-
"docusaurus-plugin-internaldocs-fb": "^1.19.1",
33+
"docusaurus-plugin-internaldocs-fb": "^1.19.3",
3434
"react": "^18.3.1",
3535
"react-dom": "^18.3.1",
3636
"react-loadable": "^5.5.0",
@@ -70,12 +70,13 @@
7070
]
7171
},
7272
"engines": {
73-
"node": ">=18",
73+
"node": ">=22",
7474
"npm": "use yarn instead",
7575
"yarn": "^1.5"
7676
},
7777
"resolutions": {
7878
"cheerio": "1.0.0-rc.12",
79-
"@mdx-js/react": "^3.1.0"
79+
"@mdx-js/react": "^3.1.0",
80+
"langium": "^4.2.2"
8081
}
8182
}

0 commit comments

Comments
 (0)