Repository navigation
fix(deps): force tinypool to a patched major in docs - #692
Open
krishnaGajabi wants to merge 1 commit into
Open
krishnaGajabi wants to merge 1 commit into
krishnaGajabi wants to merge 1 commit into
Conversation
tinypool 1.1.1 comes in through @docusaurus/core and is affected by GHSA-5gmw-xhrv-c9v3 and GHSA-85c8-ppgw-ccpr, prototype pollution gadgets that reach code execution through worker options. There is no patched 1.x -- the fixes are in 2.1.1 and 2.1.2 -- and @docusaurus/core still declares ^1.0.2 at 3.10.2, so an override is the only way to take them. tinypool 2.0.0 changes nothing but the supported Node floor, which this package already clears: it asks for Node >= 22, and the workflows and Netlify both build on 24. Also takes proxy-addr 2.0.8 for GHSA-jqcg-44mw-7w3h, which express already allows within its declared ~2.0.7. Signed-off-by: krishnaGajabi <gajbikrishna23@gmail.com>
krishnaGajabi
marked this pull request as ready for review
October 30, 2026 07:45
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the three critical Dependabot alerts on
docs/that have no automated fix.^2.1.2Why tinypool needs an override. It is reachable only through
@docusaurus/core, whichdeclares
tinypool: ^1.0.2. There is no patched 1.x release — the fixes are in 2.1.1 and2.1.2 — so Dependabot cannot raise this one on its own.
Upstream will not backport it, and that is worth reading before reviewing. The request was
filed as meta/docusaurus#12584 and closed as not planned, with two backport PRs (#12585,
#12758) closed alongside it. The maintainers' reasoning is that these advisories assume
tinypool sandboxes worker code, which Docusaurus does not rely on — its SSG workers already run
with full host privileges, so the advisory grants no access that a plugin or any other
build-time dependency does not already have.
So this override is closing an audit finding, not an exploitable hole in this site. It is
still worth taking: it is the only way these three alerts go away while we are on Docusaurus 3,
and
mainupstream is already on tinypool 2.x, so the override simply lands early where v4will arrive anyway.
Why the major bump is safe. tinypool 2.0.0's only breaking change is dropping Node 18
(
fix!: drop Node 18 support).docs/package.jsonalready requires Node >= 22, and.github/workflows/*anddocs/netlify.tomlboth pin Node 24.Verified with a clean
npm cianddocusaurus buildon Node 24.22.2 / npm 11.19.1 —[SUCCESS] Generated static files in "build".Deliberately left out, since Dependabot already has them open:
docs/— chore(deps): Bump shell-quote from 1.10.0 to 1.12.0 in /docs #677website/— chore(deps-dev): Bump proxy-addr from 2.0.7 to 2.0.8 in /website #683