Commit d70ef9a
{Website} Upgrade docusaurus-plugin-internaldocs-fb to unblock lodash-es security fix
Summary:
GitHub Dependabot cannot create a security PR to upgrade lodash-es from 4.17.23 to 4.18.1 because the transitive dependency chain pins it to an exact version:
docusaurus-plugin-internaldocs-fb@1.19.2 → chevrotain@11.1.1 → lodash-es "4.17.23" (exact, no caret)
This diff upgrades docusaurus-plugin-internaldocs-fb from ^1.19.1 to ^1.19.3, which replaces the chevrotain dependency with mermaid (uses lodash-es "^4.17.23", allowing 4.18.1). It also adds a yarn resolution for langium >= 4.2.2, because langium 4.2.1 still pulls in chevrotain 11.1.1; langium 4.2.2 switches to chevrotain 12.0.0, which dropped lodash-es entirely.
After this change, no chevrotain 11.x remains in yarn.lock, and all lodash-es references use ^ semver ranges compatible with 4.18.1.
Differential Revision: D1020575451 parent b953585 commit d70ef9a
2 files changed
Lines changed: 63 additions & 418 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
30 | 30 | | |
31 | 31 | | |
32 | 32 | | |
33 | | - | |
| 33 | + | |
34 | 34 | | |
35 | 35 | | |
36 | 36 | | |
| |||
76 | 76 | | |
77 | 77 | | |
78 | 78 | | |
79 | | - | |
| 79 | + | |
| 80 | + | |
80 | 81 | | |
81 | 82 | | |
0 commit comments