chore(deps): patch browser-reachable + direct security advisories#32
Merged
Conversation
…mermaid, js-yaml, docusaurus) Addresses the GitHub Dependabot alerts that actually reach the shipped static site or are direct dependencies: - dompurify 3.4.0 -> 3.4.12 (resolution ^3.4.11): 8 GHSA advisories; ships to the browser via mermaid's sanitizer. - mermaid 11.12.3 -> 11.16.0 (new resolution ^11.15.0): 4 GHSA advisories; 29 diagrams render client-side. Verified in-browser, no console errors. - js-yaml ^4.1.1 -> ^4.3.0: direct devDependency; clears the 2 advisories that `yarn npm audit` also confirms. - @docusaurus/* 3.10.0 -> 3.10.2: patch bump, refreshes the toolchain. After this, `yarn npm audit --all` reports 0 advisories. The ~27 remaining Dependabot alerts are all dev/build-tooling transitive deps (webpack-dev-server, shell-quote, ws, undici, @babel/*, tar, qs, etc.), each one patch behind its GHSA fix. None execute in the deployed static bundle; handled separately (annotate) rather than force-bumping the whole toolchain here. Validated: yarn ci:locale-quality green (en+ru build + audits); playwright 174 passed (1 pre-existing layout flake, passes 3/3 on isolated rerun); mermaid diagrams render correctly with 11.16.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H8DjaLbA7Ed63XuSAENrJ7
Deploying builder-docs with
|
| Latest commit: |
1021084
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://8026e205.builder-docs.pages.dev |
| Branch Preview URL: | https://chore-dependabot-minimal.builder-docs.pages.dev |
mikedotexe
added a commit
that referenced
this pull request
Jul 21, 2026
…an older build) No content change. Four PRs merged within ~3 minutes (#32, #33, #30, #31) and their Cloudflare Pages deployments finished out of order: #33 fe452e4 14:01:28 #31 f914d2f 14:02:13 <- newest commit (contains the RPC endpoint-URL fix) #30 99a2520 14:02:56 <- finished LAST CF Pages points the production alias at the last deployment to *finish*, not the newest commit, so docs.fastnear.com got pinned to #30's build (main.6e03125c.js), which predates the RPC fix. Result: the live docs still rendered a fabricated `https://rpc.mainnet.fastnear.com/account/view_account` instead of the real base endpoint. This empty commit forces a fresh production deployment of current main, which already contains the fix. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H8DjaLbA7Ed63XuSAENrJ7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
GitHub reports 41 Dependabot alerts on
builder-docs. Investigation found they are not stale but the installed versions sit one patch behind the newest GHSA fixes. Reachability split:dompurify,mermaid(mermaid is enabled; 29 diagrams render client-side, processing trusted authored content).webpack-dev-server,shell-quote,ws,undici,@babel/*,tar,qs, …).yarn npm audit --environment productionwas already clean;yarn npm audit --allflagged onlyjs-yaml(npm's advisory DB is narrower than GHSA).This PR — the browser-reachable + direct set
dompurify^3.4.11)mermaid^11.15.0)js-yamlyarn npm auditconfirms@docusaurus/*After:
yarn npm audit --all→ 0 advisories.Not in this PR
The ~27 remaining alerts are dev/build-tooling transitives, each one patch behind its GHSA fix, none of which execute in the deployed static bundle. Left for annotation on the security tab rather than force-bumping the whole toolchain (which the "full sweep" option deliberately declined).
Validation
yarn ci:locale-quality(the CI gate) — green (en+ru build + RU/i18n/indexing audits)yarn test:e2e— 174 passed; 1 pre-existing layout flake (copy actions stay side by side) passes 3/3 on isolated rerun🤖 Generated with Claude Code
https://claude.ai/code/session_01H8DjaLbA7Ed63XuSAENrJ7