microsoft / microsoft/hve-core

fix(docs): remove deprecated dependencies from Docusaurus install

Open
#2,790 0 comments 0 reactions 1 assignee Claimed by @jkim323 View on GitHub
bug dependencies documentation maintainers-only maintenance needs-triage npm priority-3 security
Dominant language
Python
Stars
1.5k
Forks
301
Avg merge
3d 3h
Merged PRs (30d)
92

Description

### Component

Documentation

### Bug Description

Running `npm ci` from `docs/docusaurus` emits deprecation warnings for unsupported dependencies in the documentation build and test toolchain:

- `glob@7.2.3`
- `glob@10.5.0`
- `inflight@1.0.6`
- `whatwg-encoding@3.1.1`

The `glob` package metadata warns that these unsupported versions contain publicly known security vulnerabilities fixed in current releases. `inflight` is unsupported and reports a memory-leak risk. `whatwg-encoding` is deprecated in favor of `@exodus/bytes`.

Current dependency paths include:

- Jest/Babel coverage tooling -> `babel-plugin-istanbul` -> `test-exclude` -> `glob@7.2.3` -> `inflight@1.0.6`
- Jest packages -> `glob@10.5.0`
- `eslint-plugin-mdx` -> `eslint-mdx` -> `unified-engine` and `load-plugin` -> npm CLI packages -> `glob@10.5.0`
- `@easyops-cn/docusaurus-search-local` -> `cheerio` -> `encoding-sniffer` -> `whatwg-encoding@3.1.1`

This is priority 3 because the affected packages are in the documentation build/test dependency graph and no exploitable HVE-Core path has been demonstrated. It should still be addressed as security-related dependency maintenance because unsupported vulnerable versions remain locked and restored in development and CI environments.

### Expected Behavior

`npm ci` in `docs/docusaurus` should restore maintained dependency versions without warnings for the four packages above, while preserving documentation build, lint, type-check, unit-test, and end-to-end behavior.

### Steps to Reproduce

1. Check out the current default branch.
2. Change directory to `docs/docusaurus`.
3. Run `npm ci`.
4. Observe the deprecation warnings for the listed packages.

### Additional Context

Issue #2628 tracks similar warnings in the repository-root `alex` dependency graph, but explicitly excludes the nested Docusaurus dependency tree. Its generated implementation issue #2629 also addresses only the root graph. No existing issue was found for the Docusaurus-specific warning set.

Acceptance criteria:

- Remove the listed deprecated package versions from `docs/docusaurus/package-lock.json` through supported direct dependency upgrades, replacements, or narrowly justified compatible resolutions.
- Avoid unsupported cross-major overrides unless compatibility is demonstrated by the owning documentation and test suites.
- Regenerate the lockfile using `https://registry.npmjs.org/` with `sha512` integrity metadata.
- Confirm `npm ci` no longer emits warnings for these packages.
- Preserve Docusaurus build, lint, type-check, unit-test, and end-to-end behavior.
- Confirm the dependency change introduces no new npm audit findings.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.