FrankChen021 opened a new pull request, #19814: URL: https://github.com/apache/druid/pull/19814
## Dependency **Depends on [#19788](https://github.com/apache/druid/pull/19788) and must be merged after #19788.** This is a stacked PR based on #19788 head commit `65630f6ab7100e1e82f160054d90dd502a2d1b7b`. Its website dependency changes assume the Docusaurus and Node.js updates from that PR. ## Changes - Refresh compatible transitive website dependencies to their patched releases. - Add targeted npm overrides for transitive constraints that otherwise retain vulnerable versions: - `brace-expansion` 5.0.8 - `serialize-javascript` 7.0.5 - `sockjs`'s `uuid` 11.1.1 - `tmp` 0.2.7 - Regenerate `website/package-lock.json` with the repository-pinned npm 10.8.2. This covers all **50 currently open Dependabot alerts** for `website/package-lock.json`, spanning 27 packages. A range-by-range check against the GitHub alert metadata found zero installed versions within any reported vulnerable range. The change only affects the documentation website dependency graph. It does not change Druid runtime or web-console dependencies. ## Validation - `npx --yes [email protected] ci` - `npm ls --all --omit=optional` - `npm run build` - `npm run link-lint` - `npm run spellcheck` (264 files) - Explicit verification of all 50 alert ranges against every matching package occurrence in the lockfile The production build succeeds with the existing broken-anchor warnings. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
