[krassx]

Why

Dependabot reports 47 open alerts (18 critical, 19 high) on package-lock.json. All are transitive build/dev tooling — none ship in the static site. Root deps are already at latest (Docusaurus 3.10.2), so the alerts cannot be cleared by bumping root packages (only TypeScript 7 is newer, unrelated to the alerts).

What

1. npm update inside existing semver ranges: clears most of nanoid, postcss, ws, qs, body-parser, path-to-regexp, picomatch, launch-editor, joi, shell-quote, @babel/*, websocket-driver, follow-redirects, etc.
2. overrides for the three that Docusaurus 3.10.2 still pins to vulnerable versions:
   • tinypool 1.1.1 → ^2.2.0 (critical, via @docusaurus/core)
   • serialize-javascript 6.0.2 → ^7.1.4 (high, via @docusaurus/bundler: copy-webpack-plugin, css-minimizer-webpack-plugin)
   • uuid → ^11.1.1 (moderate, via sockjs/webpack-dev-server)

Result

npm audit: 43 → 5, all low, remaining = deepmerge (@svgr), which has no patched upstream version.

Verified

• npm run build succeeds (560 HTML pages), npm run typecheck clean, cspell clean.

Review note

Overrides cross major versions (tinypool 1→2, serialize-javascript 6→7); the build passes, but remove them once Docusaurus ships updated pins. Not touched: Dependabot PR #10 (TypeScript 7 major, draft).

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

• Documentation
  • Updated the documented minimum Node.js version to 20.18.1.
• Chores
  • The project now requires Node.js 20.18.1 or later. Ensure your environment meets this requirement before installing or running the project.

The package configuration and documentation now require Node.js 20.18.1 or later. The package configuration also adds overrides for tinypool, serialize-javascript under two dependencies, and uuid under sockjs.

Suggested reviewers: dsheikherev

Change: Other

Merge Risk: Minimal · up to 29633

The dependency overrides and documented Node.js requirement are consistent. No merge-blocking issue is established; merge after normal checks pass.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title names the main change: refreshing the lockfile and adding overrides for vulnerable transitive build dependencies. The changeset matches this. The title is concise and specific.
Description check		The description explains the reason for the change (Dependabot alerts on transitive build tooling), the changes (npm update, the tinypool, serialize-javascript, and uuid overrides), the audit result, …
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the reason for the change (Dependabot alerts on transitive build tooling), the changes (npm update, the tinypool, serialize-javascript, and uuid overrides), the audit result, and the verification steps. It relates directly to the changeset.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8ed74f81-6a8d-48ce-a98e-a6f32dd9b8bc

Commits

Reviewing files that changed from the base of the PR and between c9f88dc and 2963324.

Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

Files selected for processing: 3

• .claude/CLAUDE.md
• README.md
• package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[claude]

Claude finished @krassx's task in 1m 57s —— View job

---

Review of PR #157: dependency security refresh

• Read the diff and the surrounding config
• Check the overridden packages' consumers, engines and APIs
• Run npm ci, npm ls, npm audit, docusaurus build, typecheck and cspell
• Post findings

What I ran (Node 22.23.4, locally)

• npm ci installs cleanly from the lockfile.
• npm ls shows the overrides applied: tinypool 2.2.0, serialize-javascript 7.1.4 (deduped across both webpack plugins), uuid 11.1.1.
• npm audit reports 5 low-severity findings, all from @svgr/* (deepmerge). This matches the PR description.
• docusaurus build succeeds and produces 559 index.html pages plus 404.html.
  • The build went through the tinypool 2 SSG thread pool (4 threads). ssgExecutor.js does import('tinypool').then(m => m.default), and tinypool 2 still exports default.
• uuid@11 works with require('uuid').v4, which is how sockjs calls it.
• npm run typecheck and cspell are clean.
• I did not test on Node 20 or run the dev server (npm start).

Findings (2 inline, both P3 Low)

1. package.json:56-60: overrides are global and unscoped. They force major-version jumps for every dependent. Suggest scoping each one to its parent, or adding a tracking issue to remove them once Docusaurus updates its pins. This is a maintainability note, not a defect today.
2. package.json:54: engines.node >=20.0 is now looser than the lockfile. cheerio@1.2.0 and undici@7.30.1 need >=20.18.1. CI uses the latest Node 20.x, so it is unaffected. Only contributors on older Node 20 versions would see problems.

I found no earlier review comments, so nothing is repeated here.

Summary

1. Overall risk: Low. All changes are transitive build and dev tooling, and nothing ships in the static site.
2. Merge recommendation: Approve and merge. The two findings are optional.
3. Most important issues:
   • Scope the overrides or track their removal.
   • Raise the engines floor to >=20.18.1.
4. Positives:
   • The audit count drops from 43 to 5, all low.
   • The PR description documents the cross-major overrides honestly.
   • The overrides are limited to the three packages that cannot be fixed by npm update.
   • Verification was reproducible. I confirmed it, including that the build exercises the tinypool 2 path.
     · Branch: chore/deps-security-refresh

[claude]

Severity: P3 Low
Problem: These three overrides are global, so they apply to every dependent in the tree. Today the only affected parents are @docusaurus/core (tinypool), copy-webpack-plugin and css-minimizer-webpack-plugin (serialize-javascript), and sockjs (uuid). The overrides also force major-version jumps (tinypool 1→2, serialize-javascript 6→7, uuid 8→11) with no scoping.
Impact: A later npm update or new dependency that needs the old major of one of these packages will be silently forced onto the new one, with no peer or resolution warning. The failure would then show up only at build time. Nothing in the repo reminds anyone to remove the overrides once Docusaurus ships new pins.
Scenario: A future Docusaurus minor still declares tinypool@^1, but its SSG code changes to use a v1-only option. The override keeps tinypool at 2.x and the build breaks, with no hint that the override is the cause.
Fix: Optionally scope each override to its parent, for example "@docusaurus/core": { "tinypool": "^2.2.0" }, "copy-webpack-plugin": { "serialize-javascript": "^7.1.4" }, and so on. Alternatively, leave a TODO or tracking issue to drop the overrides when Docusaurus bumps its pins. package.json has no comment field, so a tracking issue or a note in the README is the practical option.

For reference, I ran npm ci, a full docusaurus build, typecheck and cspell on the branch, and all passed. The build used the tinypool 2 thread pool (4 threads), and uuid@11 still works through require('uuid').v4, which is how sockjs calls it. So this is a maintainability note, not a defect.

[claude]

Severity: P3 Low
Problem: The refreshed lockfile now resolves cheerio@1.2.0 (under docusaurus-search-local) and undici@7.30.1, both of which declare node >=20.18.1. Here engines.node is still >=20.0.
Impact: Node 20.0 to 20.17 now satisfies the repo's declared range but not these dependencies. A contributor on one of those versions could hit engine warnings, or errors under engine-strict, or runtime errors.
Scenario: A contributor with an older Node 20.x runs npm ci followed by npm run build. CI is unaffected, because actions/setup-node with node-version: 20 resolves to the latest 20.x.
Fix: Optionally raise engines.node to >=20.18.1. CLAUDE.md's "Node >= 20" note could stay as is, or be updated to match.

[krassx]

Addressed both review findings (6020b41, plus a README sync):

1. Overrides scoped to parents — @docusaurus/core → tinypool ^2.2.0; copy-webpack-plugin / css-minimizer-webpack-plugin → serialize-javascript ^7.1.4; sockjs → uuid ^11.1.1. Resolved versions and npm audit are unchanged (5 low, deepmerge only). Follow-up: drop these overrides when a Docusaurus release updates its own pins (check on each Docusaurus bump).
2. engines.node raised to >=20.18.1 to match cheerio 1.2.0 / undici 7.30.1 in the lockfile (verified in package-lock.json); CLAUDE.md and README updated to match.

Re-verified: npm ci --dry-run, npm run build, npm run typecheck, cspell all pass.

Human guided, AI implemented

[claude]

PR #157 was updated after the trigger (6020b41 -> 2963324). Push again or mention Claude to run on the latest version.

[claude]

Claude finished @krassx's task in 47s —— View job

---

Re-review of PR #157 after the latest pushes

• Read the new commits (6020b41, 2963324)
• Check whether the earlier findings are fixed
• Re-run npm ci, npm ls, npm audit, typecheck and cspell
• Post summary

Earlier findings: both fixed

1. Unscoped overrides (P3): fixed. The overrides are now scoped to their parents in package.json:

   • @docusaurus/core → tinypool ^2.2.0
   • copy-webpack-plugin and css-minimizer-webpack-plugin → serialize-javascript ^7.1.4
   • sockjs → uuid ^11.1.1

   npm ls confirms each one resolves as intended: tinypool 2.2.0, serialize-javascript 7.1.4 (deduped), uuid 11.1.1. A future dependency that needs the old majors is no longer forced onto the new ones. The tracking-issue part of my earlier suggestion is still optional.

2. engines.node floor (P3): fixed. It is now >=20.18.1, and README.md and .claude/CLAUDE.md match. I scanned the lockfile's engines fields. Nothing requires a Node 20.x floor above 20.18.1.

What I ran this time (Node 24.22.1, locally)

• npm ci --ignore-scripts installs cleanly.
• npm ls tinypool serialize-javascript uuid shows the scoped overrides applied.
• npm audit reports 5 low findings, all from @svgr/* (deepmerge), as before.
• npm run typecheck is clean.
• cspell is clean: 359 files, 0 issues.
• I did not re-run the full docusaurus build or the dev server this time. My earlier run passed, and these commits only scope the overrides and change the engines floor and docs text.
• I did not test on Node 20.

New findings

None.

Summary

1. Overall risk: Low. Only transitive build and dev tooling changed, and nothing ships in the static site.
2. Merge recommendation: Approve and merge. A reviewer needs to submit the formal approval, since I can't.
3. Most important issues: None blocking. Optionally, open a tracking issue to drop the overrides once Docusaurus updates its pins.
4. Positives:
   • Both earlier review points were addressed promptly.
   • The overrides are narrow and scoped to the packages that npm update could not fix.
   • The engines floor, README and CLAUDE.md are consistent.
   • The audit count drops from 43 to 5, all low.
     · Branch: chore/deps-security-refresh