Upgrade Docusaurus 2.4.3 → 3.10.2 (clears all website vulnerabilities) - #193
Merged
Merged
Conversation
Migrates the docs site to Docusaurus 3, which refreshes the transitive dependency tree and resolves 66 of the 68 Dependabot advisories natively. The remaining two (serialize-javascript, uuid) are pinned via resolutions. Net result: `yarn audit` reports 0 vulnerabilities. Changes: - Bump @docusaurus/* to ^3.10.2, react/react-dom to ^18, @mdx-js/react to ^3, prism-react-renderer to ^2; swap @tsconfig/docusaurus for @docusaurus/tsconfig; add @types/react ^18; bump typescript to ~5.6.3. - Drop the Docusaurus 2 resolutions patchwork (incl. the webpack 5.94.0 pin, which was only needed to dodge 2.4.3's schema-utils v4 build break); keep only serialize-javascript + uuid pins and an @types/react dedupe. - prism-react-renderer v2 import (themes.github). - MDX v3: convert installation.md Tabs from the mdx-code-block idiom to native JSX; DownloadPicker uses a documented cast since v3 narrows TabItem.label to string while still rendering ReactNode. - Migrate onBrokenMarkdownLinks to markdown.hooks; add onBrokenAnchors: 'throw' and fix a pre-existing broken anchor in releases.md. - Add a ts-node CommonJS override so the deploy step's download_links.ts still runs under the new esnext module config. Verified: yarn install --frozen-lockfile, lint:check, typecheck, build, ts-node download_links.ts, and yarn audit (0 vulnerabilities) all pass; Tabs and DownloadPicker icons render correctly in the built HTML.
StefanSteiner
added a commit
that referenced
this pull request
Sep 22, 2026
…ies (#193) (#194) Migrates the docs site to Docusaurus 3, which refreshes the transitive dependency tree and resolves 66 of the 68 Dependabot advisories natively. The remaining two (serialize-javascript, uuid) are pinned via resolutions. Net result: `yarn audit` reports 0 vulnerabilities. Changes: - Bump @docusaurus/* to ^3.10.2, react/react-dom to ^18, @mdx-js/react to ^3, prism-react-renderer to ^2; swap @tsconfig/docusaurus for @docusaurus/tsconfig; add @types/react ^18; bump typescript to ~5.6.3. - Drop the Docusaurus 2 resolutions patchwork (incl. the webpack 5.94.0 pin, which was only needed to dodge 2.4.3's schema-utils v4 build break); keep only serialize-javascript + uuid pins and an @types/react dedupe. - prism-react-renderer v2 import (themes.github). - MDX v3: convert installation.md Tabs from the mdx-code-block idiom to native JSX; DownloadPicker uses a documented cast since v3 narrows TabItem.label to string while still rendering ReactNode. - Migrate onBrokenMarkdownLinks to markdown.hooks; add onBrokenAnchors: 'throw' and fix a pre-existing broken anchor in releases.md. - Add a ts-node CommonJS override so the deploy step's download_links.ts still runs under the new esnext module config. Verified: yarn install --frozen-lockfile, lint:check, typecheck, build, ts-node download_links.ts, and yarn audit (0 vulnerabilities) all pass; Tabs and DownloadPicker icons render correctly in the built HTML.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrades the docs site from Docusaurus 2.4.3 → 3.10.2. Docusaurus 3's refreshed dependency tree resolves 66 of the 68 Dependabot advisories natively; the remaining two (
serialize-javascript,uuid) are pinned viaresolutions.yarn auditnow reports 0 vulnerabilities.This supersedes the earlier resolutions workaround — the whole Docusaurus 2 patchwork (including the
webpack: 5.94.0pin, which only existed to dodge 2.4.3's schema-utils v4 build break) is removed.Changes
@docusaurus/*→^3.10.2,react/react-dom→^18.3.1,@mdx-js/react→^3.1.1,prism-react-renderer→^2.4.1; swap@tsconfig/docusaurus→@docusaurus/tsconfig; add@types/react^18;typescript→~5.6.3.serialize-javascript+uuidpins and an@types/reactdedupe (fixes duplicate-React-types tsc errors).require('prism-react-renderer').themes.github.installation.mdTabs from themdx-code-blockidiom to native JSX (v3 rejects JSX tags spanning fenced blocks).DownloadPickeruses a small documented cast because v3 narrowsTabItem.labeltostringwhile still rendering ReactNode at runtime (keeps the OS icon labels).onBrokenMarkdownLinks→markdown.hooks.onBrokenMarkdownLinks; addedonBrokenAnchors: 'throw'and fixed a pre-existing broken anchor inreleases.md(#passingprocesssettings→#process-settings, now caught by D3's anchor checking).tsconfig.jsonso the deploy step'sdownload_links.tsstill runs under the newesnextmodule config.Test plan
yarn install --frozen-lockfileyarn run lint:check(prettier)yarn run typecheck(tsc) — cleanyarn build(Docusaurus 3 production build) — success, no warningsyarn ts-node download_links.ts(deploy step) — runsyarn audit— 0 vulnerabilities (was 68)buildjob passesNote
Build + lint + typecheck + rendered-HTML checks all pass, but I could not run a live browser here. A quick manual pass over the deployed preview (tabs, download picker OS detection, Algolia search, dark mode) is worth doing before merge.