Skip to content

Upgrade Docusaurus to 3.10.1 in metro website#1724

Closed
cortinico wants to merge 1 commit into
mainfrom
export-D107522586
Closed

Upgrade Docusaurus to 3.10.1 in metro website#1724
cortinico wants to merge 1 commit into
mainfrom
export-D107522586

Conversation

@cortinico

@cortinico cortinico commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

Summary:
Upgrade docusaurus/core and docusaurus/preset-classic from 3.6.3 to 3.10.1 in the metro website. This upgrades webpack-dev-server from 4.x to 5.x, which eliminates several vulnerable transitive dependencies.

Also adds a resolution for serialize-javascript to force 7.0.5 (fixes GHSA-5c6j-r48x-rmvq, code injection via RegExp.flags).

Key changes from Docusaurus 3.10.1:

  • webpack-dev-server 4.15.2 → 5.2.4 (drops sockjs, http-proxy-middleware)
  • serialize-javascript 6.0.2 → 7.0.5 (via resolution)

Reviewed By: GijsWeterings

Differential Revision: D107522586

@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Jun 4, 2026
@meta-codesync

meta-codesync Bot commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

@cortinico has exported this pull request. If you are a Meta employee, you can view the originating Diff in D107522586.

Summary:
Upgrade `docusaurus/core` and `docusaurus/preset-classic` from 3.6.3 to 3.10.1 in the metro website. This upgrades `webpack-dev-server` from 4.x to 5.x, which eliminates several vulnerable transitive dependencies.

Also adds a resolution for `serialize-javascript` to force 7.0.5 (fixes GHSA-5c6j-r48x-rmvq, code injection via RegExp.flags).

Key changes from Docusaurus 3.10.1:
- `webpack-dev-server` 4.15.2 → 5.2.4 (drops sockjs, http-proxy-middleware)
- `serialize-javascript` 6.0.2 → 7.0.5 (via resolution)

Reviewed By: GijsWeterings

Differential Revision: D107522586
@meta-codesync

meta-codesync Bot commented Jun 5, 2026

Copy link
Copy Markdown
Contributor

This pull request has been merged in cf7de96.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. fb-exported Merged meta-exported

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant