microsoft / microsoft/hve-core

chore: Hard-pin docusaurus overrides to clear npm audit vulnerabilities

Open Beginner friendly
#2,236 0 comments 0 reactions 0 assignees View on GitHub
maintenance needs-triage
Dominant language
Python
Stars
1.5k
Forks
301
Avg merge
3d 3h
Merged PRs (30d)
92

Description

Hard-pin the docusaurus dependency overrides in `package.json` to remediate open `npm audit` findings for `undici`, `http-proxy-middleware`, and `js-yaml`, achieving `npm audit 0`.

Parent tracking issue: #2232

## Acceptance Criteria
- [ ] Docusaurus dependency overrides for `undici`, `http-proxy-middleware`, and `js-yaml` are hard-pinned in `package.json`
- [ ] `npm audit` reports 0 vulnerabilities after the change
- [ ] Docusaurus build remains functional
Related to #2232

> Generated by [Issue Triage](https://github.com/microsoft/hve-core/actions/runs/28349762609) for issue #2232 · 98.6 AIC · ⌖ 13.4 AIC · ⊞ 28.5K · [◷](https://github.com/search?q=repo%3Amicrosoft%2Fhve-core+is%3Aissue+%22gh-aw-workflow-call-id%3A+microsoft%2Fhve-core%2Fissue-triage%22&type=issues)

Contributor guide

Open the contributing guide

Research direction

Start in package.json by reviewing the Docusaurus dependency overrides and the affected packages: undici, http-proxy-middleware, and js-yaml. Run npm audit before and after the change, then verify that the Docusaurus build remains functional; done means the overrides are hard-pinned and npm audit reports zero vulnerabilities.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
build-system, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
76/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.