Commit 80d2097
{Website} Fix lodash-es security vulnerability by upgrading deps and Node to 22 (#341)
Summary:
Pull Request resolved: #341
Dependabot fails to upgrade lodash-es to the safe version (4.18.1) because chevrotain@11.1.1 pins it to exactly 4.17.23.
Changes:
- Upgrade docusaurus-plugin-internaldocs-fb ^1.19.1 → ^1.19.3 (drops direct chevrotain dep, uses mermaid instead)
- Add yarn resolution langium ^4.2.2 (uses chevrotain 12.0.0 which removed lodash-es entirely)
- Upgrade Node 20 → 22 in publish-website.yml + package.json engines (chevrotain 12.0.0 requires Node ≥ 22)
After this change, all lodash-es references in yarn.lock use ^ semver ranges, allowing Dependabot to upgrade to 4.18.1.
Reviewed By: ryanfrawley
Differential Revision: D102057545
fbshipit-source-id: 39c8438a3b7c1c85b032dfc4a60f514e251916ad1 parent b953585 commit 80d2097
3 files changed
Lines changed: 68 additions & 419 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
23 | 23 | | |
24 | 24 | | |
25 | 25 | | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
26 | 30 | | |
27 | 31 | | |
28 | 32 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
30 | 30 | | |
31 | 31 | | |
32 | 32 | | |
33 | | - | |
| 33 | + | |
34 | 34 | | |
35 | 35 | | |
36 | 36 | | |
| |||
70 | 70 | | |
71 | 71 | | |
72 | 72 | | |
73 | | - | |
| 73 | + | |
74 | 74 | | |
75 | 75 | | |
76 | 76 | | |
77 | 77 | | |
78 | 78 | | |
79 | | - | |
| 79 | + | |
| 80 | + | |
80 | 81 | | |
81 | 82 | | |
0 commit comments