ab118d9f13
docs/pnpm-lock.yaml had never been scanned (the nightly supply-chain job covered uv.lock only): trivy found 116 advisories, 5 critical — proxy-addr, shell-quote, websocket-driver, plus fast-uri, js-yaml, brace-expansion, nanoid, lodash, path-to-regexp, picomatch, … `pnpm update` within the existing ranges under the same 7-day release cooldown (--config.minimum-release-age=10080), on pnpm 10.34.7: Docusaurus 3.7 -> 3.10.2, 116 -> 7 findings. The 7 left need majors Docusaurus pins against (tinypool 1 -> 2, serialize-javascript 6 -> 7, uuid 8 -> 11) or a patch younger than the cooldown (body-parser 1.20.9, 5 days): build-time / dev-server only — uuid and body-parser sit under webpack-dev-server, which `docusaurus build` never starts, and nothing they touch reaches the static site. Left to upstream + Renovate rather than forced overrides. Refs #1365
45 lines
1.0 KiB
JSON
45 lines
1.0 KiB
JSON
{
|
|
"name": "stack-docs",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"scripts": {
|
|
"docusaurus": "docusaurus",
|
|
"start": "docusaurus start",
|
|
"build": "docusaurus build",
|
|
"swizzle": "docusaurus swizzle",
|
|
"clear": "docusaurus clear",
|
|
"serve": "docusaurus serve"
|
|
},
|
|
"dependencies": {
|
|
"@docusaurus/core": "^3.10.2",
|
|
"@docusaurus/preset-classic": "^3.10.2",
|
|
"@easyops-cn/docusaurus-search-local": "^0.55.3",
|
|
"@mdx-js/react": "^3.1.1",
|
|
"clsx": "^2.1.1",
|
|
"prism-react-renderer": "^2.4.1",
|
|
"react": "^18.3.1",
|
|
"react-dom": "^18.3.1"
|
|
},
|
|
"devDependencies": {
|
|
"@docusaurus/module-type-aliases": "^3.10.2",
|
|
"@docusaurus/types": "^3.10.2",
|
|
"typescript": "~5.6.3"
|
|
},
|
|
"browserslist": {
|
|
"production": [
|
|
">0.5%",
|
|
"not dead",
|
|
"not op_mini all"
|
|
],
|
|
"development": [
|
|
"last 3 chrome version",
|
|
"last 3 firefox version",
|
|
"last 5 safari version"
|
|
]
|
|
},
|
|
"engines": {
|
|
"node": ">=18.0"
|
|
},
|
|
"packageManager": "pnpm@10.34.7"
|
|
}
|