Bump webpack-dev-server, @docusaurus/core and @docusaurus/preset-classic in /docs#19
Bump webpack-dev-server, @docusaurus/core and @docusaurus/preset-classic in /docs#19dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) to 5.2.5 and updates ancestor dependencies [webpack-dev-server](https://github.com/webpack/webpack-dev-server), [@docusaurus/core](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus) and [@docusaurus/preset-classic](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic). These dependencies need to be updated together. Updates `webpack-dev-server` from 4.15.1 to 5.2.5 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v4.15.1...v5.2.5) Updates `@docusaurus/core` from 2.4.0 to 3.10.1 - [Release notes](https://github.com/facebook/docusaurus/releases) - [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG-v2.md) - [Commits](https://github.com/facebook/docusaurus/commits/v3.10.1/packages/docusaurus) Updates `@docusaurus/preset-classic` from 2.4.0 to 3.10.1 - [Release notes](https://github.com/facebook/docusaurus/releases) - [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG-v2.md) - [Commits](https://github.com/facebook/docusaurus/commits/v3.10.1/packages/docusaurus-preset-classic) --- updated-dependencies: - dependency-name: webpack-dev-server dependency-version: 5.2.5 dependency-type: indirect - dependency-name: "@docusaurus/core" dependency-version: 3.10.1 dependency-type: direct:production - dependency-name: "@docusaurus/preset-classic" dependency-version: 3.10.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 3 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 743336f. Configure here.
| "@docusaurus/core": "2.4.0", | ||
| "@docusaurus/preset-classic": "2.4.0", | ||
| "@docusaurus/core": "3.10.1", | ||
| "@docusaurus/preset-classic": "3.10.1", |
There was a problem hiding this comment.
Node engine below Docusaurus requirement
High Severity
engines.node still allows Node 18, while @docusaurus/core 3.10.1 requires Node 20+. Local docusaurus start/build and any CI or deploy image on Node 18 can fail even though package.json claims support.
Reviewed by Cursor Bugbot for commit 743336f. Configure here.
| "@docusaurus/core": "2.4.0", | ||
| "@docusaurus/preset-classic": "2.4.0", | ||
| "@docusaurus/core": "3.10.1", | ||
| "@docusaurus/preset-classic": "3.10.1", |
There was a problem hiding this comment.
Stale npm2yarn remark plugin
Medium Severity
@docusaurus/remark-plugin-npm2yarn remains on the 2.4 line while core and preset are 3.10.1. The v3-aligned plugin (3.x) targets MDX 3 and current Tabs/TabItem behavior; the v2 plugin can break MDX compilation or npm/yarn tab blocks site-wide.
Reviewed by Cursor Bugbot for commit 743336f. Configure here.
| "@docusaurus/core": "2.4.0", | ||
| "@docusaurus/preset-classic": "2.4.0", | ||
| "@docusaurus/core": "3.10.1", | ||
| "@docusaurus/preset-classic": "3.10.1", |
There was a problem hiding this comment.
React 17 with Docusaurus 3
Medium Severity
react and react-dom stay on 17 while @docusaurus/core 3.10.1 peers require React 18 or 19, and the root still depends on @mdx-js/react 1.x instead of 3.x. That unsupported stack can cause install peer warnings, duplicate React trees, or MDX/runtime errors after the upgrade.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 743336f. Configure here.
There was a problem hiding this comment.
Risk: high. Not approving: Bugbot finished skipped and flagged 3 compatibility issues (Node 18 vs Docusaurus 3’s Node 20+, React 17/MDX v1 vs React 18+, stale npm2yarn plugin). This is a major Docusaurus 2→3 bump, not a low-risk lockfile-only change. Requesting baskaryan and hwchase17 for review.
Sent by Cursor Approval Agent: Pull Request Approver
|
Superseded by #23. |
Bumps webpack-dev-server to 5.2.5 and updates ancestor dependencies webpack-dev-server, @docusaurus/core and @docusaurus/preset-classic. These dependencies need to be updated together.
Updates
webpack-dev-serverfrom 4.15.1 to 5.2.5Release notes
Sourced from webpack-dev-server's releases.
... (truncated)
Changelog
Sourced from webpack-dev-server's changelog.
... (truncated)
Commits
c3ee325chore(release): new release (#5682)60173befeat: add changeset validation and release workflow (#5680)948d5e6fix(proxy): match the HMR upgrade path exactly like the ws server (#5678)93e8996fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...fd40130chore(release): 5.2.4ece4f36chore: update deps (#5661)a216144ci: fix test (#5658)df073c5Merge commit from forkb550a70chore(release): 5.2.39704dc5chore: upgrade selfsigned to v5 and remove node-forge dependency (#5618)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-server since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
@docusaurus/corefrom 2.4.0 to 3.10.1Release notes
Sourced from @docusaurus/core's releases.
... (truncated)
Changelog
Sourced from @docusaurus/core's changelog.
... (truncated)
Commits
41c1a45v3.10.1d4164aechore: cherry-pick commits for v3.10.1 patch release (#11982)4892e7ffeat(core): addfuture.v4.mdx1CompatDisabledByDefaultflag (#11896)543eaebfix(core): fixurl.resolve()Node.js deprecation warning (#11844)1a52592fix(faster): upgrade Rspack, fix Yarn PnP support (#11817)4a0273ffix(create-docusaurus): fix support for TypeScript 6.0 + fix our CI (#11843)f659aeffix(core): upgrade serve handler min version to for upgrade users to a secure...1451780chore(ci): fixes for the npm trusted publishing workflow (#11823)5dff744chore(ci): add Trusted Publishing release workflow through dispatch action (#...29c3b5cfeat(core): Docusaurus Faster is stable + v4 future flag turns it on by defau...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@docusaurus/coresince your current version.Updates
@docusaurus/preset-classicfrom 2.4.0 to 3.10.1Release notes
Sourced from @docusaurus/preset-classic's releases.
... (truncated)
Changelog
Sourced from @docusaurus/preset-classic's changelog.
... (truncated)
Commits
41c1a45v3.10.11451780chore(ci): fixes for the npm trusted publishing workflow (#11823)5dff744chore(ci): add Trusted Publishing release workflow through dispatch action (#...bca9ce7chore: release v3.9.2 (#11491)c3e5db1chore: release v3.9.1 (#11436)c24d7dcchore: release v3.9 (#11419)1c484e1chore: drop support for Node 18, that reached End-of-Life (#11408)f811e2dchore: release 3.8.1 (#11249)b126e64chore: release Docusaurus 3.8 (#11200)abd04a2feat(theme): new CSS cascade layers plugin + built-in `v4.useCssCascadeLayers...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@docusaurus/preset-classicsince your current version.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
High Risk
Major Docusaurus 2→3 with large transitive tree changes; peer/engine mismatches with current React 17 and Node 18 declarations can break local dev and CI builds until resolved.
Overview
Updates
docsdependencies so@docusaurus/coreand@docusaurus/preset-classicmove from 2.4.0 to 3.10.1, with the lockfile refreshed accordingly.webpack-dev-serveris pulled in transitively by Docusaurus and lands on 5.2.5 (from the v4 line used under Docusaurus 2).This is a major Docusaurus upgrade, not a patch-only dev-server fix. Expect different MDX/webpack tooling and stricter runtime requirements from v3 (e.g. Node ≥20 and React 18+ peers on
@docusaurus/core), whiledocs/package.jsonstill declares React 17,@mdx-js/react^1, andengines.node≥18—soyarn start/yarn buildshould be verified and may need follow-up alignment of React, MDX, and Node version docs/CI.Reviewed by Cursor Bugbot for commit 743336f. Bugbot is set up for automated code reviews on this repo. Configure here.