Skip to content

Commit d70ef9a

Browse files
kongchen1992facebook-github-bot
authored andcommitted
{Website} Upgrade docusaurus-plugin-internaldocs-fb to unblock lodash-es security fix
Summary: GitHub Dependabot cannot create a security PR to upgrade lodash-es from 4.17.23 to 4.18.1 because the transitive dependency chain pins it to an exact version: docusaurus-plugin-internaldocs-fb@1.19.2 → chevrotain@11.1.1 → lodash-es "4.17.23" (exact, no caret) This diff upgrades docusaurus-plugin-internaldocs-fb from ^1.19.1 to ^1.19.3, which replaces the chevrotain dependency with mermaid (uses lodash-es "^4.17.23", allowing 4.18.1). It also adds a yarn resolution for langium >= 4.2.2, because langium 4.2.1 still pulls in chevrotain 11.1.1; langium 4.2.2 switches to chevrotain 12.0.0, which dropped lodash-es entirely. After this change, no chevrotain 11.x remains in yarn.lock, and all lodash-es references use ^ semver ranges compatible with 4.18.1. Differential Revision: D102057545
1 parent b953585 commit d70ef9a

2 files changed

Lines changed: 63 additions & 418 deletions

File tree

website/package.json

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030
"@mdx-js/react": "^3.1.0",
3131
"@types/react": "^18.3.3",
3232
"clsx": "^2.1.1",
33-
"docusaurus-plugin-internaldocs-fb": "^1.19.1",
33+
"docusaurus-plugin-internaldocs-fb": "^1.19.3",
3434
"react": "^18.3.1",
3535
"react-dom": "^18.3.1",
3636
"react-loadable": "^5.5.0",
@@ -76,6 +76,7 @@
7676
},
7777
"resolutions": {
7878
"cheerio": "1.0.0-rc.12",
79-
"@mdx-js/react": "^3.1.0"
79+
"@mdx-js/react": "^3.1.0",
80+
"langium": "^4.2.2"
8081
}
8182
}

0 commit comments

Comments
 (0)