Fix open Dependabot alerts in website npm dependencies - #1920
Merged
Badrish Chandramouli (badrishc) merged 2 commits intoJul 9, 2026
Conversation
Resolves 14 open Dependabot alerts for transitive npm dependencies in website/yarn.lock by bumping them to patched versions: - dompurify 3.4.0 -> 3.4.11 (resolution) — #108-#114, #117 - qs 6.14.2 -> 6.15.2 (new resolution; parent pins ~6.14.0) — #99 - js-yaml 3.14.2 -> 3.15.0, 4.1.1 -> 4.3.0 (in-range) — #125, #126 - ws 7.5.10 -> 7.5.11, 8.20.0 -> 8.21.0 (in-range) — #98, #103, #104 js-yaml and ws patched versions are within existing semver ranges, so their lockfile entries were re-resolved rather than force-pinned (avoids collapsing their two majors onto a single version). Verified with yarn install --frozen-lockfile and a full yarn build. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot started reviewing on behalf of
Badrish Chandramouli (badrishc)
July 8, 2026 23:03
View session
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Docusaurus website’s npm dependency lockfile and Yarn resolutions to address Dependabot-reported vulnerabilities in transitive packages, without changing Garnet server/runtime code.
Changes:
- Updated
resolutionsinwebsite/package.jsonto pindompurifyto3.4.11and add a new pin forqsat6.15.2(with updated CVE annotation comments). - Re-resolved
website/yarn.locksodompurify,qs,js-yaml(3.x and 4.x), andws(7.x and 8.x) are now at the stated patched versions.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| website/package.json | Bumps/adds Yarn resolutions entries for dompurify and qs, and updates the related CVE comment strings. |
| website/yarn.lock | Updates lockfile entries to the patched versions for dompurify, qs, js-yaml (3.x/4.x), and ws (7.x/8.x). |
kevin-montrose
approved these changes
Jul 9, 2026
Vasileios Zois (vazois)
approved these changes
Jul 9, 2026
Badrish Chandramouli (badrishc)
deleted the
badrishc/fix-dependabot-npm-alerts
branch
July 9, 2026 17:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Resolves all 14 open Dependabot alerts, which are transitive npm dependencies in
website/yarn.lock, by bumping them to patched versions.How
resolutions; bumped3.4.0→3.4.11and updated the CVE comment (adds CVE-2026-49458/49459/49978).resolutionsentry6.15.2, since the parent pins~6.14.0which blocks the fix (CVE-2026-8723).yarn.lockentries were re-resolved rather than force-pinned — this avoids collapsing their two separate majors onto a single version.Validation
yarn install --frozen-lockfile→ lockfile consistentyarn build→ site builds successfully (only pre-existing broken-anchor doc warnings)website/package.json+website/yarn.lock