microsoft / microsoft/hve-core
fix(docs): remove deprecated dependencies from Docusaurus install
- Dominant language
- Python
- Stars
- 1.5k
- Forks
- 301
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 92
Description
### Component
Documentation
### Bug Description
Running `npm ci` from `docs/docusaurus` emits deprecation warnings for unsupported dependencies in the documentation build and test toolchain:
- `glob@7.2.3`
- `glob@10.5.0`
- `inflight@1.0.6`
- `whatwg-encoding@3.1.1`
The `glob` package metadata warns that these unsupported versions contain publicly known security vulnerabilities fixed in current releases. `inflight` is unsupported and reports a memory-leak risk. `whatwg-encoding` is deprecated in favor of `@exodus/bytes`.
Current dependency paths include:
- Jest/Babel coverage tooling -> `babel-plugin-istanbul` -> `test-exclude` -> `glob@7.2.3` -> `inflight@1.0.6`
- Jest packages -> `glob@10.5.0`
- `eslint-plugin-mdx` -> `eslint-mdx` -> `unified-engine` and `load-plugin` -> npm CLI packages -> `glob@10.5.0`
- `@easyops-cn/docusaurus-search-local` -> `cheerio` -> `encoding-sniffer` -> `whatwg-encoding@3.1.1`
This is priority 3 because the affected packages are in the documentation build/test dependency graph and no exploitable HVE-Core path has been demonstrated. It should still be addressed as security-related dependency maintenance because unsupported vulnerable versions remain locked and restored in development and CI environments.
### Expected Behavior
`npm ci` in `docs/docusaurus` should restore maintained dependency versions without warnings for the four packages above, while preserving documentation build, lint, type-check, unit-test, and end-to-end behavior.
### Steps to Reproduce
1. Check out the current default branch.
2. Change directory to `docs/docusaurus`.
3. Run `npm ci`.
4. Observe the deprecation warnings for the listed packages.
### Additional Context
Issue #2628 tracks similar warnings in the repository-root `alex` dependency graph, but explicitly excludes the nested Docusaurus dependency tree. Its generated implementation issue #2629 also addresses only the root graph. No existing issue was found for the Docusaurus-specific warning set.
Acceptance criteria:
- Remove the listed deprecated package versions from `docs/docusaurus/package-lock.json` through supported direct dependency upgrades, replacements, or narrowly justified compatible resolutions.
- Avoid unsupported cross-major overrides unless compatibility is demonstrated by the owning documentation and test suites.
- Regenerate the lockfile using `https://registry.npmjs.org/` with `sha512` integrity metadata.
- Confirm `npm ci` no longer emits warnings for these packages.
- Preserve Docusaurus build, lint, type-check, unit-test, and end-to-end behavior.
- Confirm the dependency change introduces no new npm audit findings.
Contributor guide
Assessment
This issue has not been assessed yet.