[github-actions]

2 dependency updates · 2 security fixes · Validation passed

Validation

• Frozen install: passed.
• Project checks: passed.

Security status

2 security fixes · 40 affected package entries remain (16 critical).

Security fixes

🟢 Fixes in 2 packages

Package	Affected package entries	Action / blocker	Advisories
🟢 dompurify	1 fixed	Resolved.	GHSA-c6gr-qvv4-5v3f (+2 additional advisories; see full audit details)
🟢 follow-redirects	1 fixed	Resolved.	GHSA-8r9p-f939-6h3c (+1 additional advisory; see full audit details)

All dependency changes

• dompurify: 3.4.16 → 3.4.17
• follow-redirects: 1.16.0 → 1.16.1

Security findings and blockers

🟢 Fixes in 2 packages · 🟠 20 packages need your review · ⚪ 20 packages need verification

Package	Affected package entries	Action / blocker
🟢 dompurify	1 fixed	Resolved.
🟢 follow-redirects	1 fixed	Resolved.
🟠 @docusaurus/core	1 pending	The offered fix requires a major upgrade.
🟠 @docusaurus/preset-classic	1 pending	The offered fix requires a major upgrade.
🟠 @docusaurus/theme-mermaid	1 pending	The offered fix requires a major upgrade.
🟠 tinypool	1 pending	The offered fix requires a major upgrade.
🟠 @docusaurus/bundler	1 pending	The offered fix requires a major upgrade.
🟠 css-minimizer-webpack-plugin	1 pending	The offered fix requires a major upgrade.
🟠 cssnano	1 pending	The offered fix requires a major upgrade.
🟠 cssnano-preset-default	1 pending	The offered fix requires a major upgrade.
🟠 postcss-calc	1 pending	The offered fix requires a major upgrade.
🟠 postcss-merge-rules	1 pending	The offered fix requires a major upgrade.
🟠 postcss-selector-parser	1 pending	The offered fix requires a major upgrade.
🟠 postcss-unique-selectors	1 pending	The offered fix requires a major upgrade.
🟠 sockjs	1 pending	The offered fix requires a major upgrade.
🟠 uuid	1 pending	The offered fix requires a major upgrade.
🟠 webpack-dev-server	1 pending	The offered fix requires a major upgrade.
🟠 @mermaid-js/layout-elk	1 pending	The offered fix requires a major upgrade.
🟠 copy-webpack-plugin	1 pending	The offered fix requires a major upgrade.
🟠 katex	1 pending	The offered fix requires a major upgrade.
🟠 mermaid	1 pending	The offered fix requires a major upgrade.
🟠 serialize-javascript	1 pending	The offered fix requires a major upgrade.
⚪ @docusaurus/plugin-content-blog	1 pending	Fix availability or resolution is unconfirmed.
⚪ @docusaurus/plugin-content-docs	1 pending	Fix availability or resolution is unconfirmed.
⚪ @docusaurus/plugin-content-pages	1 pending	Fix availability or resolution is unconfirmed.
⚪ @docusaurus/plugin-css-cascade-layers	1 pending	Fix availability or resolution is unconfirmed.
⚪ @docusaurus/plugin-debug	1 pending	Fix availability or resolution is unconfirmed.
⚪ @docusaurus/plugin-google-analytics	1 pending	Fix availability or resolution is unconfirmed.
⚪ @docusaurus/plugin-google-gtag	1 pending	Fix availability or resolution is unconfirmed.
⚪ @docusaurus/plugin-google-tag-manager	1 pending	Fix availability or resolution is unconfirmed.
⚪ @docusaurus/plugin-sitemap	1 pending	Fix availability or resolution is unconfirmed.
⚪ @docusaurus/plugin-svgr	1 pending	Fix availability or resolution is unconfirmed.
⚪ @docusaurus/theme-classic	1 pending	Fix availability or resolution is unconfirmed.
⚪ @docusaurus/theme-search-algolia	1 pending	Fix availability or resolution is unconfirmed.
⚪ body-parser	1 pending	Fix availability or resolution is unconfirmed.
⚪ @docusaurus/cssnano-preset	1 pending	Fix availability or resolution is unconfirmed.
⚪ cssnano-preset-advanced	1 pending	Fix availability or resolution is unconfirmed.
⚪ fast-uri	1 pending	Fix availability or resolution is unconfirmed.
⚪ postcss-discard-unused	1 pending	Fix availability or resolution is unconfirmed.
⚪ postcss-merge-longhand	1 pending	Fix availability or resolution is unconfirmed.
⚪ postcss-minify-selectors	1 pending	Fix availability or resolution is unconfirmed.
⚪ stylehacks	1 pending	Fix availability or resolution is unconfirmed.

Additional dependency change details

Security findings and fixes

• dompurify: 3.4.16 → 3.4.17; no longer reported by npm.
• follow-redirects: 1.16.0 → 1.16.1; no longer reported by npm.

Full before/after npm audit

Remaining advisories

Affected package entries: info: 0, low: 5, moderate: 18, high: 1, critical: 16, total: 40

• @docusaurus/core: critical; locked versions 3.10.2; affected range <=3.10.2; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected @docusaurus/bundler (see its entry).
  • Depends on affected tinypool (see its entry).
  • Depends on affected webpack-dev-server (see its entry).
• @docusaurus/plugin-content-blog: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-content-docs: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-content-pages: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-css-cascade-layers: critical; locked versions 3.10.2; affected range <=3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-debug: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-google-analytics: critical; locked versions 3.10.2; affected range >=3.8.0-canary-6324; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-google-gtag: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-google-tag-manager: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-sitemap: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-svgr: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/preset-classic: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate @docusaurus/preset-classic@3.7.0; requires breaking changes; manual review.
  • Depends on affected @docusaurus/core (see its entry).
  • Depends on affected @docusaurus/plugin-content-blog (see its entry).
  • Depends on affected @docusaurus/plugin-content-docs (see its entry).
  • Depends on affected @docusaurus/plugin-content-pages (see its entry).
  • Depends on affected @docusaurus/plugin-css-cascade-layers (see its entry).
  • Depends on affected @docusaurus/plugin-debug (see its entry).
  • Depends on affected @docusaurus/plugin-google-analytics (see its entry).
  • Depends on affected @docusaurus/plugin-google-gtag (see its entry).
  • Depends on affected @docusaurus/plugin-google-tag-manager (see its entry).
  • Depends on affected @docusaurus/plugin-sitemap (see its entry).
  • Depends on affected @docusaurus/plugin-svgr (see its entry).
  • Depends on affected @docusaurus/theme-classic (see its entry).
  • Depends on affected @docusaurus/theme-search-algolia (see its entry).
• @docusaurus/theme-classic: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
  • Depends on affected @docusaurus/plugin-content-blog (see its entry).
  • Depends on affected @docusaurus/plugin-content-docs (see its entry).
  • Depends on affected @docusaurus/plugin-content-pages (see its entry).
• @docusaurus/theme-mermaid: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 4.0.0-canary-6810; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
  • Depends on affected @docusaurus/core (see its entry).
  • Depends on affected @mermaid-js/layout-elk (see its entry).
• @docusaurus/theme-search-algolia: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
  • Depends on affected @docusaurus/plugin-content-docs (see its entry).
• tinypool: critical; locked versions 1.1.1; affected range <=2.1.1; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution; critical; affected range <=2.1.0.
  • Tinypool: Prototype Pollution Gadget to RCE in run() options; critical; affected range <2.1.2.
• body-parser: high; locked versions 1.20.8; affected range <1.20.9; npm fix candidate available.
  • body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body; high; affected range <1.20.9.
• @docusaurus/bundler: moderate; locked versions 3.10.2; affected range <=3.10.2; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected @docusaurus/cssnano-preset (see its entry).
  • Depends on affected copy-webpack-plugin (see its entry).
  • Depends on affected css-minimizer-webpack-plugin (see its entry).
  • Depends on affected cssnano (see its entry).
• @docusaurus/cssnano-preset: moderate; locked versions 3.10.2; affected range <=3.10.2; npm fix candidate available.
  • Depends on affected cssnano-preset-advanced (see its entry).
• css-minimizer-webpack-plugin: moderate; locked versions 5.0.1; affected range <=7.0.4; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected cssnano (see its entry).
  • Depends on affected serialize-javascript (see its entry).
• cssnano: moderate; locked versions 6.1.2; affected range 4.0.0-nightly.2020.1.9 - 6.1.2; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected cssnano-preset-default (see its entry).
• cssnano-preset-advanced: moderate; locked versions 6.1.2; affected range <=5.2.4 || 5.3.1 - 6.1.2; npm fix candidate available.
  • Depends on affected cssnano-preset-default (see its entry).
  • Depends on affected postcss-discard-unused (see its entry).
• cssnano-preset-default: moderate; locked versions 6.1.2; affected range <=7.0.0; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected postcss-calc (see its entry).
  • Depends on affected postcss-merge-longhand (see its entry).
  • Depends on affected postcss-merge-rules (see its entry).
  • Depends on affected postcss-minify-selectors (see its entry).
  • Depends on affected postcss-unique-selectors (see its entry).
• fast-uri: moderate; locked versions 3.1.8; affected range 3.0.0 - 3.1.8; npm fix candidate available.
  • fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding; moderate; affected range >=3.0.0 <3.1.9.
  • fast-uri vulnerable to improper path equivalence in relative reference normalization; low; affected range >=3.0.0 <3.1.9.
  • fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization; moderate; affected range >=3.1.3 <3.1.9.
  • fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references; low; affected range >=3.0.0 <3.1.9.
• postcss-calc: moderate; locked versions 9.0.1; affected range 6.0.0 - 10.0.2; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected postcss-selector-parser (see its entry).
• postcss-discard-unused: moderate; locked versions 6.0.5; affected range 4.0.0-nightly.2020.1.9 - 7.0.3; npm fix candidate available.
  • Depends on affected postcss-selector-parser (see its entry).
• postcss-merge-longhand: moderate; locked versions 6.0.5; affected range 3.0.0 - 6.0.5; npm fix candidate available.
  • Depends on affected stylehacks (see its entry).
• postcss-merge-rules: moderate; locked versions 6.1.1; affected range 2.1.0 - 7.0.4; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected postcss-selector-parser (see its entry).
• postcss-minify-selectors: moderate; locked versions 6.0.4; affected range 1.4.0 - 7.0.4; npm fix candidate available.
  • Depends on affected postcss-selector-parser (see its entry).
• postcss-selector-parser: moderate; locked versions 6.1.4; affected range <7.1.6; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion; moderate; affected range <7.1.6.
• postcss-unique-selectors: moderate; locked versions 6.0.4; affected range 4.0.0-nightly.2020.1.9 - 4.0.0-rc.2 || 5.0.0-rc.0 - 7.0.3; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected postcss-selector-parser (see its entry).
• sockjs: moderate; locked versions 0.3.24; affected range >=0.3.17; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected uuid (see its entry).
• stylehacks: moderate; locked versions 6.1.1; affected range <=7.0.4; npm fix candidate available.
  • Depends on affected postcss-selector-parser (see its entry).
• uuid: moderate; locked versions 8.3.2; affected range <11.1.1; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided; moderate; affected range <11.1.1.
• webpack-dev-server: moderate; locked versions 5.2.6; affected range 2.0.0-beta - 5.2.7; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected sockjs (see its entry).
• @mermaid-js/layout-elk: low; locked versions 0.1.9; affected range <=0.2.3; npm fix candidate @mermaid-js/layout-elk@1.0.1; requires breaking changes; manual review.
  • Depends on affected mermaid (see its entry).
• copy-webpack-plugin: low; locked versions 11.0.0; affected range 4.3.0 - 13.0.1; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected serialize-javascript (see its entry).
• katex: low; locked versions 0.16.47; affected range 0.11.0 - 0.18.1; npm fix candidate @mermaid-js/layout-elk@1.0.1; requires breaking changes; manual review.
  • KaTeX: Existing prototype pollution can bypass trust restrictions; low; affected range >=0.11.0 <0.18.2.
• mermaid: low; locked versions 11.17.2; affected range 10.9.0-rc.1 - 12.1.0; npm fix candidate @mermaid-js/layout-elk@1.0.1; requires breaking changes; manual review.
  • Depends on affected katex (see its entry).
• serialize-javascript: low; locked versions 7.0.5; affected range <7.1.3; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body; low; affected range <7.1.3.

Before

info: 0, low: 5, moderate: 18, high: 2, critical: 17, total: 42

• @docusaurus/core: critical; locked versions 3.10.2; affected range <=3.10.2; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected @docusaurus/bundler (see its entry).
  • Depends on affected tinypool (see its entry).
  • Depends on affected webpack-dev-server (see its entry).
• @docusaurus/plugin-content-blog: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-content-docs: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-content-pages: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-css-cascade-layers: critical; locked versions 3.10.2; affected range <=3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-debug: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-google-analytics: critical; locked versions 3.10.2; affected range >=3.8.0-canary-6324; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-google-gtag: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-google-tag-manager: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-sitemap: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/plugin-svgr: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
• @docusaurus/preset-classic: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate @docusaurus/preset-classic@3.7.0; requires breaking changes; manual review.
  • Depends on affected @docusaurus/core (see its entry).
  • Depends on affected @docusaurus/plugin-content-blog (see its entry).
  • Depends on affected @docusaurus/plugin-content-docs (see its entry).
  • Depends on affected @docusaurus/plugin-content-pages (see its entry).
  • Depends on affected @docusaurus/plugin-css-cascade-layers (see its entry).
  • Depends on affected @docusaurus/plugin-debug (see its entry).
  • Depends on affected @docusaurus/plugin-google-analytics (see its entry).
  • Depends on affected @docusaurus/plugin-google-gtag (see its entry).
  • Depends on affected @docusaurus/plugin-google-tag-manager (see its entry).
  • Depends on affected @docusaurus/plugin-sitemap (see its entry).
  • Depends on affected @docusaurus/plugin-svgr (see its entry).
  • Depends on affected @docusaurus/theme-classic (see its entry).
  • Depends on affected @docusaurus/theme-search-algolia (see its entry).
• @docusaurus/theme-classic: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
  • Depends on affected @docusaurus/plugin-content-blog (see its entry).
  • Depends on affected @docusaurus/plugin-content-docs (see its entry).
  • Depends on affected @docusaurus/plugin-content-pages (see its entry).
• @docusaurus/theme-mermaid: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 4.0.0-canary-6810; npm fix candidate @docusaurus/theme-mermaid@3.7.0; requires breaking changes; manual review.
  • Depends on affected @docusaurus/core (see its entry).
  • Depends on affected @mermaid-js/layout-elk (see its entry).
• @docusaurus/theme-search-algolia: critical; locked versions 3.10.2; affected range 3.8.0-canary-6324 - 3.10.2; npm fix candidate available.
  • Depends on affected @docusaurus/core (see its entry).
  • Depends on affected @docusaurus/plugin-content-docs (see its entry).
• dompurify: critical; locked versions 3.4.16; affected range <=3.4.16; npm fix candidate available.
  • DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes; critical; affected range >=3.4.4 <=3.4.16.
  • DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p); high; affected range <=3.4.16.
  • DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml; low; affected range <=3.4.16.
• tinypool: critical; locked versions 1.1.1; affected range <=2.1.1; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution; critical; affected range <=2.1.0.
  • Tinypool: Prototype Pollution Gadget to RCE in run() options; critical; affected range <2.1.2.
• body-parser: high; locked versions 1.20.8; affected range <1.20.9; npm fix candidate available.
  • body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body; high; affected range <1.20.9.
• follow-redirects: high; locked versions 1.16.0; affected range 1.16.0; npm fix candidate available.
  • follow-redirects array-form headers bypass cross-origin credential stripping; high; affected range >=1.16.0 <1.16.1.
  • follow-redirects sensitiveHeaders regex escaping can expose credential headers; high; affected range >=1.16.0 <1.16.1.
• @docusaurus/bundler: moderate; locked versions 3.10.2; affected range <=3.10.2; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected @docusaurus/cssnano-preset (see its entry).
  • Depends on affected copy-webpack-plugin (see its entry).
  • Depends on affected css-minimizer-webpack-plugin (see its entry).
  • Depends on affected cssnano (see its entry).
• @docusaurus/cssnano-preset: moderate; locked versions 3.10.2; affected range <=3.10.2; npm fix candidate available.
  • Depends on affected cssnano-preset-advanced (see its entry).
• css-minimizer-webpack-plugin: moderate; locked versions 5.0.1; affected range <=7.0.4; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected cssnano (see its entry).
  • Depends on affected serialize-javascript (see its entry).
• cssnano: moderate; locked versions 6.1.2; affected range 4.0.0-nightly.2020.1.9 - 6.1.2; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected cssnano-preset-default (see its entry).
• cssnano-preset-advanced: moderate; locked versions 6.1.2; affected range <=5.2.4 || 5.3.1 - 6.1.2; npm fix candidate available.
  • Depends on affected cssnano-preset-default (see its entry).
  • Depends on affected postcss-discard-unused (see its entry).
• cssnano-preset-default: moderate; locked versions 6.1.2; affected range <=7.0.0; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected postcss-calc (see its entry).
  • Depends on affected postcss-merge-longhand (see its entry).
  • Depends on affected postcss-merge-rules (see its entry).
  • Depends on affected postcss-minify-selectors (see its entry).
  • Depends on affected postcss-unique-selectors (see its entry).
• fast-uri: moderate; locked versions 3.1.8; affected range 3.0.0 - 3.1.8; npm fix candidate available.
  • fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding; moderate; affected range >=3.0.0 <3.1.9.
  • fast-uri vulnerable to improper path equivalence in relative reference normalization; low; affected range >=3.0.0 <3.1.9.
  • fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization; moderate; affected range >=3.1.3 <3.1.9.
  • fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references; low; affected range >=3.0.0 <3.1.9.
• postcss-calc: moderate; locked versions 9.0.1; affected range 6.0.0 - 10.0.2; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected postcss-selector-parser (see its entry).
• postcss-discard-unused: moderate; locked versions 6.0.5; affected range 4.0.0-nightly.2020.1.9 - 7.0.3; npm fix candidate available.
  • Depends on affected postcss-selector-parser (see its entry).
• postcss-merge-longhand: moderate; locked versions 6.0.5; affected range 3.0.0 - 6.0.5; npm fix candidate available.
  • Depends on affected stylehacks (see its entry).
• postcss-merge-rules: moderate; locked versions 6.1.1; affected range 2.1.0 - 7.0.4; npm fix candidate available.
  • Depends on affected postcss-selector-parser (see its entry).
• postcss-minify-selectors: moderate; locked versions 6.0.4; affected range 1.4.0 - 7.0.4; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected postcss-selector-parser (see its entry).
• postcss-selector-parser: moderate; locked versions 6.1.4; affected range <7.1.6; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion; moderate; affected range <7.1.6.
• postcss-unique-selectors: moderate; locked versions 6.0.4; affected range 4.0.0-nightly.2020.1.9 - 4.0.0-rc.2 || 5.0.0-rc.0 - 7.0.3; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected postcss-selector-parser (see its entry).
• sockjs: moderate; locked versions 0.3.24; affected range >=0.3.17; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected uuid (see its entry).
• stylehacks: moderate; locked versions 6.1.1; affected range <=7.0.4; npm fix candidate available.
  • Depends on affected postcss-selector-parser (see its entry).
• uuid: moderate; locked versions 8.3.2; affected range <11.1.1; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided; moderate; affected range <11.1.1.
• webpack-dev-server: moderate; locked versions 5.2.6; affected range 2.0.0-beta - 5.2.7; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected sockjs (see its entry).
• @mermaid-js/layout-elk: low; locked versions 0.1.9; affected range <=0.2.3; npm fix candidate @mermaid-js/layout-elk@1.0.1; requires breaking changes; manual review.
  • Depends on affected mermaid (see its entry).
• copy-webpack-plugin: low; locked versions 11.0.0; affected range 4.3.0 - 13.0.1; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Depends on affected serialize-javascript (see its entry).
• katex: low; locked versions 0.16.47; affected range 0.11.0 - 0.18.1; npm fix candidate @mermaid-js/layout-elk@1.0.1; requires breaking changes; manual review.
  • KaTeX: Existing prototype pollution can bypass trust restrictions; low; affected range >=0.11.0 <0.18.2.
• mermaid: low; locked versions 11.17.2; affected range 10.9.0-rc.1 - 12.1.0; npm fix candidate @mermaid-js/layout-elk@1.0.1; requires breaking changes; manual review.
  • Depends on affected katex (see its entry).
• serialize-javascript: low; locked versions 7.0.5; affected range <7.1.3; npm fix candidate @docusaurus/core@3.7.0; requires breaking changes; manual review.
  • Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body; low; affected range <7.1.3.

Run configuration and audit evidence

website · npm

Routine upgrades disabled. Maintenance: 0 additional package updates (2 total).

Validation script: build · Maintenance: security-only · Routine direct upgrade scope: major

Run: 2026-10-26T07:23:19.020669+00:00

npm counts affected package entries, including propagated findings in parent packages. These are not counts of distinct advisories or demonstrated exploit paths.

• Initial security fix returned exit 1; remaining findings or a tool error require manual review.

Candidate dependency files (SHA-256)

• package.json: a277ee71b3b6e2679d97123c2bd96a63ad4547a2b36289598ca8d789630599fa
• package-lock.json: d5a2dab772cdfce4c7e051e3edd3f606eef351179d7fcb07645148b38f7ac160

Workflow run