Bump webpack-dev-server, @docusaurus/core and @docusaurus/preset-classic in /docs#23
Bump webpack-dev-server, @docusaurus/core and @docusaurus/preset-classic in /docs#23dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) to 5.2.6 and updates ancestor dependencies [webpack-dev-server](https://github.com/webpack/webpack-dev-server), [@docusaurus/core](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus) and [@docusaurus/preset-classic](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic). These dependencies need to be updated together. Updates `webpack-dev-server` from 4.15.1 to 5.2.6 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v4.15.1...v5.2.6) Updates `@docusaurus/core` from 2.4.0 to 3.10.2 - [Release notes](https://github.com/facebook/docusaurus/releases) - [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG-v2.md) - [Commits](https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus) Updates `@docusaurus/preset-classic` from 2.4.0 to 3.10.2 - [Release notes](https://github.com/facebook/docusaurus/releases) - [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG-v2.md) - [Commits](https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus-preset-classic) --- updated-dependencies: - dependency-name: webpack-dev-server dependency-version: 5.2.6 dependency-type: indirect - dependency-name: "@docusaurus/core" dependency-version: 3.10.2 dependency-type: direct:production - dependency-name: "@docusaurus/preset-classic" dependency-version: 3.10.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 6f24f77. Configure here.
| "@docusaurus/core": "2.4.0", | ||
| "@docusaurus/preset-classic": "2.4.0", | ||
| "@docusaurus/core": "3.10.2", | ||
| "@docusaurus/preset-classic": "3.10.2", |
There was a problem hiding this comment.
npm2yarn plugin major mismatch
Medium Severity
@docusaurus/remark-plugin-npm2yarn stays on ^2.4.0 while Docusaurus is upgraded to 3.10.2. The maintained plugin release line for Docusaurus 3 is 3.x; the v2 plugin targets the older MDX/remark stack and may fail to transform npm2yarn code blocks used in docusaurus.config.js.
Reviewed by Cursor Bugbot for commit 6f24f77. Configure here.
| "@docusaurus/core": "2.4.0", | ||
| "@docusaurus/preset-classic": "2.4.0", | ||
| "@docusaurus/core": "3.10.2", | ||
| "@docusaurus/preset-classic": "3.10.2", |
There was a problem hiding this comment.
Node engine below Docusaurus requirement
Medium Severity
engines.node remains >=18, but @docusaurus/core 3.10.2 and related packages require Node >=20.0. Environments that honor engines or still use Node 18 can fail when running docusaurus start or build after this bump.
Reviewed by Cursor Bugbot for commit 6f24f77. Configure here.
There was a problem hiding this comment.
Risk: medium. Not approving: this Docusaurus 2→3 bump exceeds the low-risk threshold, and Bugbot flagged an npm2yarn plugin mismatch plus engines.node still at >=18 while Docusaurus 3.10 requires Node ≥20. Human review should confirm docs build/start and align plugin/Node requirements before merge.
Sent by Cursor Approval Agent: Pull Request Approver
Bumps webpack-dev-server to 5.2.6 and updates ancestor dependencies webpack-dev-server, @docusaurus/core and @docusaurus/preset-classic. These dependencies need to be updated together.
Updates
webpack-dev-serverfrom 4.15.1 to 5.2.6Release notes
Sourced from webpack-dev-server's releases.
... (truncated)
Changelog
Sourced from webpack-dev-server's changelog.
... (truncated)
Commits
8a37b0echore(release): new release (#5697)f21ed0ffix: handle malformed Host and Origin headers (#5699)80cd9eefix: reject cross-site requests to open-editor and invalidate endpoints (#5698)308e853fix: handle undefined options in Server constructor (#5695)8b2b915chore: update branch references from v4 to v5 in workflow configuration870ed22chore: add v5 branch to release workflow triggersc3ee325chore(release): new release (#5682)60173befeat: add changeset validation and release workflow (#5680)948d5e6fix(proxy): match the HMR upgrade path exactly like the ws server (#5678)93e8996fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-server since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
@docusaurus/corefrom 2.4.0 to 3.10.2Release notes
Sourced from @docusaurus/core's releases.
... (truncated)
Changelog
Sourced from @docusaurus/core's changelog.
... (truncated)
Commits
f37f903v3.10.22f5389dchore: cherry-pick commits for v3.10.2 patch release (#12265)d4164aechore: cherry-pick commits for v3.10.1 patch release (#11982)4892e7ffeat(core): addfuture.v4.mdx1CompatDisabledByDefaultflag (#11896)543eaebfix(core): fixurl.resolve()Node.js deprecation warning (#11844)1a52592fix(faster): upgrade Rspack, fix Yarn PnP support (#11817)4a0273ffix(create-docusaurus): fix support for TypeScript 6.0 + fix our CI (#11843)f659aeffix(core): upgrade serve handler min version to for upgrade users to a secure...1451780chore(ci): fixes for the npm trusted publishing workflow (#11823)5dff744chore(ci): add Trusted Publishing release workflow through dispatch action (#...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@docusaurus/coresince your current version.Updates
@docusaurus/preset-classicfrom 2.4.0 to 3.10.2Release notes
Sourced from @docusaurus/preset-classic's releases.
... (truncated)
Changelog
Sourced from @docusaurus/preset-classic's changelog.
... (truncated)
Commits
f37f903v3.10.21451780chore(ci): fixes for the npm trusted publishing workflow (#11823)5dff744chore(ci): add Trusted Publishing release workflow through dispatch action (#...bca9ce7chore: release v3.9.2 (#11491)c3e5db1chore: release v3.9.1 (#11436)c24d7dcchore: release v3.9 (#11419)1c484e1chore: drop support for Node 18, that reached End-of-Life (#11408)f811e2dchore: release 3.8.1 (#11249)b126e64chore: release Docusaurus 3.8 (#11200)abd04a2feat(theme): new CSS cascade layers plugin + built-in `v4.useCssCascadeLayers...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@docusaurus/preset-classicsince your current version.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Medium Risk
Major Docusaurus jump (2→3) can break
start/buildor MDX without follow-up config and Node/React alignment; scope is limited to the docs package.Overview
Updates the
docssite toolchain by bumping@docusaurus/coreand@docusaurus/preset-classicfrom 2.4.0 to 3.10.2, with the lockfile refreshed so transitivewebpack-dev-servermoves from the v4 line to 5.2.x (pulled in by Docusaurus’s bundler).This is a major Docusaurus upgrade with no accompanying config or content changes in the diff—only dependency version pins and
package-lock.json.@docusaurus/remark-plugin-npm2yarnremains on the ^2.4.0 range, anddocs/package.jsonstill declaresengines.node:>=18while Docusaurus 3.10 expects Node ≥20 in the resolved tree.Reviewed by Cursor Bugbot for commit 6f24f77. Bugbot is set up for automated code reviews on this repo. Configure here.