microsoft / microsoft/hve-core
chore: Hard-pin docusaurus overrides to clear npm audit vulnerabilities
- Dominant language
- Python
- Stars
- 1.5k
- Forks
- 301
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 92
Description
Hard-pin the docusaurus dependency overrides in `package.json` to remediate open `npm audit` findings for `undici`, `http-proxy-middleware`, and `js-yaml`, achieving `npm audit 0`.
Parent tracking issue: #2232
## Acceptance Criteria
- [ ] Docusaurus dependency overrides for `undici`, `http-proxy-middleware`, and `js-yaml` are hard-pinned in `package.json`
- [ ] `npm audit` reports 0 vulnerabilities after the change
- [ ] Docusaurus build remains functional
Related to #2232
> Generated by [Issue Triage](https://github.com/microsoft/hve-core/actions/runs/28349762609) for issue #2232 · 98.6 AIC · ⌖ 13.4 AIC · ⊞ 28.5K · [◷](https://github.com/search?q=repo%3Amicrosoft%2Fhve-core+is%3Aissue+%22gh-aw-workflow-call-id%3A+microsoft%2Fhve-core%2Fissue-triage%22&type=issues)
Contributor guide
Research direction
Start in package.json by reviewing the Docusaurus dependency overrides and the affected packages: undici, http-proxy-middleware, and js-yaml. Run npm audit before and after the change, then verify that the Docusaurus build remains functional; done means the overrides are hard-pinned and npm audit reports zero vulnerabilities.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 76/100