GeezerVison is showing github.com — chore(deps): bump webpack-dev-server, @docusaurus/core and @docusaurus/preset-classic by dependabot[bot] · Pull Request #41 · celzero/docs
Conversation
Bumps webpack-dev-server to 5.2.6 and updates ancestor dependencies webpack-dev-server, @docusaurus/core and @docusaurus/preset-classic. These dependencies need to be updated together.
Updates webpack-dev-server from 3.11.2 to 5.2.6
Release notes
Sourced from webpack-dev-server's releases.
v5.2.6
Patch Changes
-
fix: allow undefined as the Server constructor options argument again (by @bjohansebas in #5695)
Restores accepting undefined (defaulting it to {}) for the options
argument, so passing a webpack config's optional devServer field type-checks and works as before.
-
Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @bjohansebas in #5698)
-
Handle malformed Host and Origin header values gracefully when validating requests. (by @bjohansebas in #5699)
v5.2.5
Patch Changes
- Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by
@bjohansebas in #5680)
v5.2.4
5.2.4 (2026-05-11)
Bug Fixes
- set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP
v5.2.3
5.2.3 (2026-01-12)
Bug Fixes
- add
cause for errorObject (#5518) (37b033d)
- compatibility with event target and universal target and lazy compilation (574026c)
- overlay: add ESC key to dismiss overlay (#5598) (f91baa8)
- progress indicator styles (#5557) (41a53a1)
- upgrade selfsigned to v5
v5.2.2
5.2.2 (2025-06-03)
Bug Fixes
- "Overlay enabled" false positive (18e72ee)
- do not crush when error is null for runtime errors (#5447) (309991f)
- remove unnecessary header
X_TEST (#5451) (64a6124)
- respect the
allowedHosts option for cross-origin header check (#5510) (03d1214)
v5.2.1
5.2.1 (2025-03-26)
... (truncated)
Changelog
Sourced from webpack-dev-server's changelog.
5.2.6
Patch Changes
-
fix: allow undefined as the Server constructor options argument again (by @bjohansebas in #5695)
Restores accepting undefined (defaulting it to {}) for the options
argument, so passing a webpack config's optional devServer field type-checks and works as before.
-
Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @bjohansebas in #5698)
-
Handle malformed Host and Origin header values gracefully when validating requests. (by @bjohansebas in #5699)
5.2.5
Patch Changes
- Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by
@bjohansebas in #5680)
All notable changes to this project will be documented in this file. See standard-version for commit guidelines.
5.2.4 (2026-05-11)
Bug Fixes
- set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP
5.2.3 (2026-01-12)
Bug Fixes
- add
cause for errorObject (#5518) (37b033d)
- compatibility with event target and universal target and lazy compilation (574026c)
- overlay: add ESC key to dismiss overlay (#5598) (f91baa8)
- progress indicator styles (#5557) (41a53a1)
- upgrade selfsigned to v5
5.2.2 (2025-06-03)
Bug Fixes
- "Overlay enabled" false positive (18e72ee)
- do not crush when error is null for runtime errors (#5447) (309991f)
- remove unnecessary header
X_TEST (#5451) (64a6124)
- respect the
allowedHosts option for cross-origin header check (#5510) (03d1214)
5.2.1 (2025-03-26)
Security
... (truncated)
Commits
8a37b0e chore(release): new release (#5697)f21ed0f fix: handle malformed Host and Origin headers (#5699)80cd9ee fix: reject cross-site requests to open-editor and invalidate endpoints (#5698)308e853 fix: handle undefined options in Server constructor (#5695)8b2b915 chore: update branch references from v4 to v5 in workflow configuration870ed22 chore: add v5 branch to release workflow triggersc3ee325 chore(release): new release (#5682)60173be feat: add changeset validation and release workflow (#5680)948d5e6 fix(proxy): match the HMR upgrade path exactly like the ws server (#5678)93e8996 fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...- Additional commits viewable in compare view
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-server since your current version.
Install script changes
This version modifies prepare script that runs during installation. Review the package contents before updating.
Updates @docusaurus/core from 2.0.0-beta.4 to 3.10.2
Release notes
Sourced from @docusaurus/core's releases.
3.10.2 (2026-07-10)
Backport and cherry-pick commits from main for v3.10.2 patch release:
3.10.1 (2026-04-30)
🐛 Bug Fix
docusaurus-bundler
- #11981 fix(bundler): fix v3 webpackbar bug due to webpack breaking change (
@slorber)
🔧 Maintenance
Committers: 1
3.10.0 (2026-04-07)
🚀 New Feature
docusaurus-types, docusaurus
- #11896 feat(core): add
future.v4.mdx1CompatDisabledByDefault flag (@slorber)
- #11797 feat(core): promote
siteConfig.storage to stable + add future.v4.siteStorageNamespacing flag [Claude] (@slorber)
- #11571 feat(core): support custom html elements in head tags (
@lebalz)
create-docusaurus
- #11897 feat(create-docusaurus): update init template to
.mdx extension and strict MDX syntax (@slorber)
- #11696 feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (
@slorber)
- #11611 feat(create-docusaurus): enable creation in current directory (
@Mcheung7272)
- Other
... (truncated)
Changelog
Sourced from @docusaurus/core's changelog.
Docusaurus Changelog - v2.x
2.4.3 (2023-09-20)
🐛 Bug Fix
docusaurus-plugin-content-docs
- #9107 fix(content-docs): sidebar generator should return customProps for doc items (
@TheCatLady)
docusaurus-theme-classic
- #9108 feat(theme-classic): add description & keywords microdata to blog posts (
@TheCatLady)
- #9099 fix(theme): only set classname on ul elements if they have an existing class (
@homotechsual)
- #9243 fix(theme-common): ThemedComponent should display something when JS is disabled (
@slorber)
docusaurus-theme-classic, docusaurus-theme-common
- #9130 fix(theme): canonical url should be not change after hydration if url accessed with/without trailing slash (
@ori-shalom)
Committers: 4
2.4.2 (2023-09-20)
Bad npm publish, please use 2.4.3
2.4.1 (2023-05-15)
🐛 Bug Fix
docusaurus-theme-classic, docusaurus-theme-common
- #8971 fix(theme): fix collapsible sidebar behavior when prefers-reduced-motion (
@slorber)
docusaurus-theme-translations
docusaurus
docusaurus-plugin-content-blog, docusaurus-theme-common, docusaurus-utils-common, docusaurus
- #8909 fix(theme): add __ prefix to technical anchors, search crawlers (Algolia) should ignore them (
@slorber)
docusaurus-theme-common
- #8906 fix(theme-common): fix collapsible component with prefers-reduced-motion (
@slorber)
- #8873 fix(theme-common): fix confusing theme error message: bad sidebar id suggestions (
@slorber)
docusaurus-utils
- #8874 fix(utils): handle Markdown links with spaces to route correctly (
@morsko1)
docusaurus-theme-classic, docusaurus-theme-translations
- #8842 fix(theme-translations): remove redundant navigation text in aria label (
@tarunrajput)
create-docusaurus
💅 Polish
... (truncated)
Commits
f37f903 v3.10.22f5389d chore: cherry-pick commits for v3.10.2 patch release (#12265)d4164ae chore: cherry-pick commits for v3.10.1 patch release (#11982)4892e7f feat(core): add future.v4.mdx1CompatDisabledByDefault flag (#11896)543eaeb fix(core): fix url.resolve() Node.js deprecation warning (#11844)1a52592 fix(faster): upgrade Rspack, fix Yarn PnP support (#11817)4a0273f fix(create-docusaurus): fix support for TypeScript 6.0 + fix our CI (#11843)f659aef fix(core): upgrade serve handler min version to for upgrade users to a secure...1451780 chore(ci): fixes for the npm trusted publishing workflow (#11823)5dff744 chore(ci): add Trusted Publishing release workflow through dispatch action (#...- Additional commits viewable in compare view
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for @docusaurus/core since your current version.
Updates @docusaurus/preset-classic from 2.0.0-beta.4 to 3.10.2
Release notes
Sourced from @docusaurus/preset-classic's releases.
3.10.2 (2026-07-10)
Backport and cherry-pick commits from main for v3.10.2 patch release:
3.10.1 (2026-04-30)
🐛 Bug Fix
docusaurus-bundler
- #11981 fix(bundler): fix v3 webpackbar bug due to webpack breaking change (
@slorber)
🔧 Maintenance
Committers: 1
3.10.0 (2026-04-07)
🚀 New Feature
docusaurus-types, docusaurus
- #11896 feat(core): add
future.v4.mdx1CompatDisabledByDefault flag (@slorber)
- #11797 feat(core): promote
siteConfig.storage to stable + add future.v4.siteStorageNamespacing flag [Claude] (@slorber)
- #11571 feat(core): support custom html elements in head tags (
@lebalz)
create-docusaurus
- #11897 feat(create-docusaurus): update init template to
.mdx extension and strict MDX syntax (@slorber)
- #11696 feat(create-docusaurus): Newly initialized TS sites should use "strict: true" (
@slorber)
- #11611 feat(create-docusaurus): enable creation in current directory (
@Mcheung7272)
- Other
... (truncated)
Changelog
Sourced from @docusaurus/preset-classic's changelog.
Docusaurus Changelog - v2.x
2.4.3 (2023-09-20)
🐛 Bug Fix
docusaurus-plugin-content-docs
- #9107 fix(content-docs): sidebar generator should return customProps for doc items (
@TheCatLady)
docusaurus-theme-classic
- #9108 feat(theme-classic): add description & keywords microdata to blog posts (
@TheCatLady)
- #9099 fix(theme): only set classname on ul elements if they have an existing class (
@homotechsual)
- #9243 fix(theme-common): ThemedComponent should display something when JS is disabled (
@slorber)
docusaurus-theme-classic, docusaurus-theme-common
- #9130 fix(theme): canonical url should be not change after hydration if url accessed with/without trailing slash (
@ori-shalom)
Committers: 4
2.4.2 (2023-09-20)
Bad npm publish, please use 2.4.3
2.4.1 (2023-05-15)
🐛 Bug Fix
docusaurus-theme-classic, docusaurus-theme-common
- #8971 fix(theme): fix collapsible sidebar behavior when prefers-reduced-motion (
@slorber)
docusaurus-theme-translations
docusaurus
docusaurus-plugin-content-blog, docusaurus-theme-common, docusaurus-utils-common, docusaurus
- #8909 fix(theme): add __ prefix to technical anchors, search crawlers (Algolia) should ignore them (
@slorber)
docusaurus-theme-common
- #8906 fix(theme-common): fix collapsible component with prefers-reduced-motion (
@slorber)
- #8873 fix(theme-common): fix confusing theme error message: bad sidebar id suggestions (
@slorber)
docusaurus-utils
- #8874 fix(utils): handle Markdown links with spaces to route correctly (
@morsko1)
docusaurus-theme-classic, docusaurus-theme-translations
- #8842 fix(theme-translations): remove redundant navigation text in aria label (
@tarunrajput)
create-docusaurus
💅 Polish
... (truncated)
Commits
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for @docusaurus/preset-classic since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR@dependabot recreate will recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Deploying docs with  Cloudflare Pages
| Latest commit: |
b1829d5
|
| Status: | 🚫 Build failed. |
View logs
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Warning Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
| Action |
Severity |
Alert (click "▶" to expand/collapse) |
| Warn |
 |
Obfuscated code: npm @pnpm/network.ca-file is 90.0% likely obfuscated
Confidence: 0.90
Location: Package overview
From: package-lock.json → npm/@docusaurus/[email protected] → npm/@pnpm/[email protected]
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
[email protected].
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@pnpm/[email protected]. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
|
| Warn |
|
Obfuscated code: npm copy-webpack-plugin is 90.0% likely obfuscated
Confidence: 0.90
Location: Package overview
From: package-lock.json → npm/@docusaurus/[email protected] → npm/[email protected]
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
[email protected].
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/[email protected]. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
|
| Warn |
|
Obfuscated code: npm webpack is 90.0% likely obfuscated
Confidence: 0.90
Location: Package overview
From: package-lock.json → npm/@docusaurus/[email protected] → npm/@docusaurus/[email protected] → npm/@easyops-cn/[email protected] → npm/[email protected]
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
[email protected].
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/[email protected]. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
|
View full report
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
This branch has not been deployed
No deployments
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|