[Snyk] Fix for 2 vulnerabilities

[leaanthony]

Snyk has created this PR to fix 2 vulnerabilities in the pnpm dependencies of this project.

Snyk changed the following file(s):

• website/package.json
• website/pnpm-lock.yaml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Prototype Pollution SNYK-JS-AXIOS-15252993	828
	Regular Expression Denial of Service (ReDoS) SNYK-JS-AJV-15274295	803

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution

[cloudflare-workers-and-pages]

Deploying wails with    Cloudflare Pages

Latest commit:	0d9e3a7
Status:	✅  Deploy successful!
Preview URL:	https://3fe10383.wails.pages.dev
Branch Preview URL:	https://snyk-fix-9a5fcc2c99a3585619a.wails.pages.dev

View logs

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch snyk-fix-9a5fcc2c99a3585619ad350218e73d24

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR is a Snyk-generated security fix that claims to address two vulnerabilities: Prototype Pollution in axios (SNYK-JS-AXIOS-15252993) and Regular Expression Denial of Service in ajv (SNYK-JS-AJV-15274295). However, the changes introduce critical issues that make this PR unsuitable for merging.

Changes:

• Downgrades @docusaurus/core from ^3.9.0 to ^3.8.0
• Downgrades @docusaurus/preset-classic from ^3.9.0 to ^3.8.0
• Leaves @docusaurus/theme-search-algolia at ^3.9.0 (unchanged)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The PR description states this fixes vulnerabilities SNYK-JS-AXIOS-15252993 (Prototype Pollution in axios) and SNYK-JS-AJV-15274295 (ReDoS in ajv), but downgrading Docusaurus packages from 3.9.0 to 3.8.0 would not fix these vulnerabilities if they exist in the current version. Security fixes require upgrading to patched versions, not downgrading. The PR description metadata indicates this should upgrade dependencies to fix vulnerabilities, but the actual changes do the opposite. This suggests either the PR was generated incorrectly by Snyk, or the intended changes were to upgrade to a newer version (possibly 3.10.0 or later) and were incorrectly applied as downgrades.

[Copilot]

This PR downgrades @docusaurus/core and @docusaurus/preset-classic from version 3.9.0 to 3.8.0, which is counterintuitive for a security fix. Security fixes typically involve upgrading to newer versions that patch vulnerabilities, not downgrading to older versions. Additionally, this creates a version mismatch with @docusaurus/theme-search-algolia which remains at version 3.9.0 (line 20), potentially causing compatibility issues between Docusaurus packages that are designed to work together at the same version.

[Copilot]

The version mismatch between Docusaurus packages will likely cause runtime issues. @docusaurus/theme-search-algolia at version 3.9.0 has peer dependencies expecting @docusaurus/core at version 3.9.x, but the core package is being downgraded to 3.8.0. All @Docusaurus packages should be kept at the same major.minor version to ensure compatibility. Either all three packages should be at 3.8.0 or all should be at 3.9.0.

[leaanthony]

@claude thoughts?

[claude]

Claude finished @leaanthony's task in 1m 22s —— View job

---

Review: This PR should NOT be merged ⚠️

I've analyzed this Snyk-generated PR and identified several critical issues that make it unsuitable for merging.

Problems Identified

1. Downgrading doesn't fix security vulnerabilities

This PR downgrades @docusaurus/core and @docusaurus/preset-classic from ^3.9.0 to ^3.8.0. Security fixes require upgrading to patched versions, not downgrading to older ones. The vulnerabilities SNYK-JS-AXIOS-15252993 and SNYK-JS-AJV-15274295 exist in dependencies (axios and ajv), and downgrading Docusaurus won't fix them - it might actually make things worse by using older dependency versions.

Reference: website/package.json:18-19

2. Version mismatch creates compatibility issues

The PR creates a version mismatch between Docusaurus packages:

• @docusaurus/core: ^3.8.0 (downgraded)
• @docusaurus/preset-classic: ^3.8.0 (downgraded)
• @docusaurus/theme-search-algolia: ^3.9.0 (unchanged)

Docusaurus packages are designed to work together at the same major.minor version. This mismatch will likely cause peer dependency warnings and potential runtime issues.

Reference: website/package.json:18-20

3. Contradictory PR metadata

The PR description claims to "upgrade" dependencies to fix vulnerabilities, but the actual changes downgrade them. This suggests the PR was either:

• Generated incorrectly by Snyk
• Intended to upgrade to a newer version (3.10.0+) but was applied incorrectly

Recommendation

Do not merge this PR. Instead:

1. Verify the vulnerabilities - Check if these vulnerabilities actually affect your Docusaurus installation by running pnpm audit or checking Snyk directly

2. Upgrade, don't downgrade - If fixes are needed, upgrade all Docusaurus packages to the same latest version (currently 3.9.0 or newer)

3. Check dependency versions - The vulnerabilities are in axios and ajv. Check if newer Docusaurus versions use patched versions of these dependencies

4. Manual fix if needed - If Snyk's auto-fix isn't working correctly, manually update the dependencies and test thoroughly

---

Tasks Completed

• Read repository guidelines (CLAUDE.md if present)
• Review package.json changes
• Analyze security vulnerability claims
• Check for version compatibility issues
• Provide comprehensive review feedback

---

[leaanthony]

Closing: master already has @docusaurus/core and @docusaurus/preset-classic at ^3.9.0, which is newer than the 3.8.0 proposed here. This PR would be a downgrade.