Skip to content

chore(deps): bump postcss, @docusaurus/core and @docusaurus/preset-classic - #43

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-59480da811
Open

chore(deps): bump postcss, @docusaurus/core and @docusaurus/preset-classic#43
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-59480da811

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown

Bumps postcss to 8.5.25 and updates ancestor dependencies postcss, @docusaurus/core and @docusaurus/preset-classic. These dependencies need to be updated together.

Updates postcss from 8.3.6 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates @docusaurus/core from 2.0.0-beta.4 to 2.4.3

Release notes

Sourced from @​docusaurus/core's releases.

2.4.3 (2023-09-20)

🐛 Bug Fix

  • docusaurus-plugin-content-docs
    • #9107 fix(content-docs): sidebar generator should return customProps for doc items (@​TheCatLady)
  • docusaurus-theme-classic
    • #9108 feat(theme-classic): add description & keywords microdata to blog posts (@​TheCatLady)
    • #9099 fix(theme): only set classname on ul elements if they have an existing class (@​homotechsual)
    • #9243 fix(theme-common): ThemedComponent should display something when JS is disabled (@​slorber)
  • docusaurus-theme-classic, docusaurus-theme-common
    • #9130 fix(theme): canonical url should be not change after hydration if url accessed with/without trailing slash (@​ori-shalom)

Committers: 4

2.4.2 (2023-09-20)

Bad npm publish, please use 2.4.3

2.4.1 (2023-05-15)

🐛 Bug Fix

  • docusaurus-theme-classic, docusaurus-theme-common
    • #8971 fix(theme): fix collapsible sidebar behavior when prefers-reduced-motion (@​slorber)
  • docusaurus-theme-translations
  • docusaurus
  • docusaurus-plugin-content-blog, docusaurus-theme-common, docusaurus-utils-common, docusaurus
    • #8909 fix(theme): add __ prefix to technical anchors, search crawlers (Algolia) should ignore them (@​slorber)
  • docusaurus-theme-common
    • #8906 fix(theme-common): fix collapsible component with prefers-reduced-motion (@​slorber)
    • #8873 fix(theme-common): fix confusing theme error message: bad sidebar id suggestions (@​slorber)
  • docusaurus-utils
    • #8874 fix(utils): handle Markdown links with spaces to route correctly (@​morsko1)
  • docusaurus-theme-classic, docusaurus-theme-translations
  • create-docusaurus

💅 Polish

  • docusaurus-theme-classic
    • #8862 refactor(theme): expose copy, success and word-wrap icons as standalone components (@​armano2)

... (truncated)

Changelog

Sourced from @​docusaurus/core's changelog.

2.4.3 (2023-09-20)

🐛 Bug Fix

  • docusaurus-plugin-content-docs
    • #9107 fix(content-docs): sidebar generator should return customProps for doc items (@​TheCatLady)
  • docusaurus-theme-classic
    • #9108 feat(theme-classic): add description & keywords microdata to blog posts (@​TheCatLady)
    • #9099 fix(theme): only set classname on ul elements if they have an existing class (@​homotechsual)
    • #9243 fix(theme-common): ThemedComponent should display something when JS is disabled (@​slorber)
  • docusaurus-theme-classic, docusaurus-theme-common
    • #9130 fix(theme): canonical url should be not change after hydration if url accessed with/without trailing slash (@​ori-shalom)

Committers: 4

2.4.2 (2023-09-20)

Bad npm publish, please use 2.4.3

2.4.1 (2023-05-15)

🐛 Bug Fix

  • docusaurus-theme-classic, docusaurus-theme-common
    • #8971 fix(theme): fix collapsible sidebar behavior when prefers-reduced-motion (@​slorber)
  • docusaurus-theme-translations
  • docusaurus
  • docusaurus-plugin-content-blog, docusaurus-theme-common, docusaurus-utils-common, docusaurus
    • #8909 fix(theme): add __ prefix to technical anchors, search crawlers (Algolia) should ignore them (@​slorber)
  • docusaurus-theme-common
    • #8906 fix(theme-common): fix collapsible component with prefers-reduced-motion (@​slorber)
    • #8873 fix(theme-common): fix confusing theme error message: bad sidebar id suggestions (@​slorber)
  • docusaurus-utils
    • #8874 fix(utils): handle Markdown links with spaces to route correctly (@​morsko1)
  • docusaurus-theme-classic, docusaurus-theme-translations
  • create-docusaurus

💅 Polish

  • docusaurus-theme-classic
    • #8862 refactor(theme): expose copy, success and word-wrap icons as standalone components (@​armano2)

... (truncated)

Commits
  • 56410aa v2.4.3
  • 4ab5a93 chore: backport retro compatible commits for the Docusaurus v2.4.2 release (#...
  • 4a2200a chore: backport retro compatible commits for the Docusaurus v2.4.1 release (#...
  • 4fb67ef chore: backport retro compatible commits for the Docusaurus v2.4 release (#8809)
  • c60387d chore: backport retro compatible commits for the Docusaurus v2.3.1 release (#...
  • c84d779 chore: backport retro compatible commits for the Docusaurus v2.3 release (#8585)
  • de97214 chore: backport retro compatible commits for the Docusaurus v2.2 release (#8264)
  • 7743aa6 chore: release Docusaurus v2.1.0 (#8040)
  • 26d2b9a chore: backport retro compatible commits for the Docusaurus v2.1 release (#8033)
  • bb65b5c chore: release v2.0.1 (#7919)
  • Additional commits viewable in compare view

Updates @docusaurus/preset-classic from 2.0.0-beta.4 to 2.4.3

Release notes

Sourced from @​docusaurus/preset-classic's releases.

2.4.3 (2023-09-20)

🐛 Bug Fix

  • docusaurus-plugin-content-docs
    • #9107 fix(content-docs): sidebar generator should return customProps for doc items (@​TheCatLady)
  • docusaurus-theme-classic
    • #9108 feat(theme-classic): add description & keywords microdata to blog posts (@​TheCatLady)
    • #9099 fix(theme): only set classname on ul elements if they have an existing class (@​homotechsual)
    • #9243 fix(theme-common): ThemedComponent should display something when JS is disabled (@​slorber)
  • docusaurus-theme-classic, docusaurus-theme-common
    • #9130 fix(theme): canonical url should be not change after hydration if url accessed with/without trailing slash (@​ori-shalom)

Committers: 4

2.4.2 (2023-09-20)

Bad npm publish, please use 2.4.3

2.4.1 (2023-05-15)

🐛 Bug Fix

  • docusaurus-theme-classic, docusaurus-theme-common
    • #8971 fix(theme): fix collapsible sidebar behavior when prefers-reduced-motion (@​slorber)
  • docusaurus-theme-translations
  • docusaurus
  • docusaurus-plugin-content-blog, docusaurus-theme-common, docusaurus-utils-common, docusaurus
    • #8909 fix(theme): add __ prefix to technical anchors, search crawlers (Algolia) should ignore them (@​slorber)
  • docusaurus-theme-common
    • #8906 fix(theme-common): fix collapsible component with prefers-reduced-motion (@​slorber)
    • #8873 fix(theme-common): fix confusing theme error message: bad sidebar id suggestions (@​slorber)
  • docusaurus-utils
    • #8874 fix(utils): handle Markdown links with spaces to route correctly (@​morsko1)
  • docusaurus-theme-classic, docusaurus-theme-translations
  • create-docusaurus

💅 Polish

  • docusaurus-theme-classic
    • #8862 refactor(theme): expose copy, success and word-wrap icons as standalone components (@​armano2)

... (truncated)

Changelog

Sourced from @​docusaurus/preset-classic's changelog.

2.4.3 (2023-09-20)

🐛 Bug Fix

  • docusaurus-plugin-content-docs
    • #9107 fix(content-docs): sidebar generator should return customProps for doc items (@​TheCatLady)
  • docusaurus-theme-classic
    • #9108 feat(theme-classic): add description & keywords microdata to blog posts (@​TheCatLady)
    • #9099 fix(theme): only set classname on ul elements if they have an existing class (@​homotechsual)
    • #9243 fix(theme-common): ThemedComponent should display something when JS is disabled (@​slorber)
  • docusaurus-theme-classic, docusaurus-theme-common
    • #9130 fix(theme): canonical url should be not change after hydration if url accessed with/without trailing slash (@​ori-shalom)

Committers: 4

2.4.2 (2023-09-20)

Bad npm publish, please use 2.4.3

2.4.1 (2023-05-15)

🐛 Bug Fix

  • docusaurus-theme-classic, docusaurus-theme-common
    • #8971 fix(theme): fix collapsible sidebar behavior when prefers-reduced-motion (@​slorber)
  • docusaurus-theme-translations
  • docusaurus
  • docusaurus-plugin-content-blog, docusaurus-theme-common, docusaurus-utils-common, docusaurus
    • #8909 fix(theme): add __ prefix to technical anchors, search crawlers (Algolia) should ignore them (@​slorber)
  • docusaurus-theme-common
    • #8906 fix(theme-common): fix collapsible component with prefers-reduced-motion (@​slorber)
    • #8873 fix(theme-common): fix confusing theme error message: bad sidebar id suggestions (@​slorber)
  • docusaurus-utils
    • #8874 fix(utils): handle Markdown links with spaces to route correctly (@​morsko1)
  • docusaurus-theme-classic, docusaurus-theme-translations
  • create-docusaurus

💅 Polish

  • docusaurus-theme-classic
    • #8862 refactor(theme): expose copy, success and word-wrap icons as standalone components (@​armano2)

... (truncated)

Commits
  • 56410aa v2.4.3
  • 4a2200a chore: backport retro compatible commits for the Docusaurus v2.4.1 release (#...
  • 4fb67ef chore: backport retro compatible commits for the Docusaurus v2.4 release (#8809)
  • c60387d chore: backport retro compatible commits for the Docusaurus v2.3.1 release (#...
  • c84d779 chore: backport retro compatible commits for the Docusaurus v2.3 release (#8585)
  • de97214 chore: backport retro compatible commits for the Docusaurus v2.2 release (#8264)
  • 7743aa6 chore: release Docusaurus v2.1.0 (#8040)
  • 26d2b9a chore: backport retro compatible commits for the Docusaurus v2.1 release (#8033)
  • bb65b5c chore: release v2.0.1 (#7919)
  • d255389 chore: prepare v2.0.0-rc.1 release (#7778)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump postcss, @docusaurus/core and @docusaurus/preset-cl…
4e4242b 
…assic

Bumps [postcss](https://github.com/postcss/postcss) to 8.5.25 and updates ancestor dependencies [postcss](https://github.com/postcss/postcss), [@docusaurus/core](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus) and [@docusaurus/preset-classic](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic). These dependencies need to be updated together.


Updates `postcss` from 8.3.6 to 8.5.25
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.3.6...8.5.25)

Updates `@docusaurus/core` from 2.0.0-beta.4 to 2.4.3
- [Release notes](https://github.com/facebook/docusaurus/releases)
- [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG-v2.md)
- [Commits](https://github.com/facebook/docusaurus/commits/v2.4.3/packages/docusaurus)

Updates `@docusaurus/preset-classic` from 2.0.0-beta.4 to 2.4.3
- [Release notes](https://github.com/facebook/docusaurus/releases)
- [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG-v2.md)
- [Commits](https://github.com/facebook/docusaurus/commits/v2.4.3/packages/docusaurus-preset-classic)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: indirect
- dependency-name: "@docusaurus/core"
  dependency-version: 2.4.3
  dependency-type: direct:production
- dependency-name: "@docusaurus/preset-classic"
  dependency-version: 2.4.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 30, 2026
@dependabot dependabot Bot mentioned this pull request Jul 30, 2026
Closed
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jul 30, 2026

Copy link
Copy Markdown

Deploying docs with  Cloudflare Pages  Cloudflare Pages

Latest commit: 4e4242b
Status:🚫  Build failed.

View logs

@socket-security

socket-security Bot commented Jul 30, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​docusaurus/​preset-classic@​2.0.0-beta.4 ⏵ 2.4.39910070 +698 +1100
Updated@​docusaurus/​core@​2.0.0-beta.4 ⏵ 2.4.39710075 +198100
Updatedclsx@​1.1.1 ⏵ 1.2.110010088 -780100

View full report

@socket-security

socket-security Bot commented Jul 30, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm copy-webpack-plugin is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/@docusaurus/core@2.4.3 → npm/copy-webpack-plugin@11.0.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/copy-webpack-plugin@11.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm node-forge is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/@docusaurus/core@2.4.3 → npm/node-forge@1.4.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/node-forge@1.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm react-textarea-autosize is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/@docusaurus/preset-classic@2.4.3 → npm/react-textarea-autosize@8.5.9

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-textarea-autosize@8.5.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm webpack is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/@easyops-cn/docusaurus-search-local@0.19.1 → npm/@docusaurus/core@2.4.3 → npm/@docusaurus/preset-classic@2.4.3 → npm/webpack@5.109.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.109.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants