Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
brandyscarney
requested changes
Aug 25, 2026
brandyscarney
left a comment
Member
There was a problem hiding this comment.
Looks good, just curious if we can fix some of the install vulnerabilities.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue URL: N/A
What is the current behavior?
Sixteen dependencies are behind, several by multiple majors. Three are declared but unused:
html-loaderhas no references anywhere,@docusaurus/plugin-client-redirectsis never registered in the plugins array (redirects are handled invercel.json), and@docusaurus/mdx-loaderis not imported and already comes in through@docusaurus/coreand@docusaurus/preset-classic.node-fetchis imported bydocusaurus.config.js, the component API plugin, and two build scripts, but it is not declared inpackage.json. It resolves only becausecspell@6happens to pull it in transitively.CI installs with
--legacy-peer-deps, added in 2023 when the workflow was first created. The matrix declares anode_versionaxis with a single value.What is the new behavior?
Removes the three unused dependencies and upgrades the rest. Minor and patch bumps for
@mdx-js/react,@prismicio/client,@stackblitz/sdk,docusaurus-plugin-copy-page-button,prism-react-renderer,sass,semver, andtypescript. Majors forclsx2,fs-extra11,modern-normalize3,@ionic-internal/ionic-ds8, andcspell10, each in its own commit.Replaces
node-fetchwith the nativefetchavailable since Node 18. This had to land before the cspell bump, becausecspell@6was the only thing providing the package and upgrading it removesnode-fetchfrom the tree entirely.Requires Node 24.
cspell@10needs at least 22.18, and this repo is self contained so there are no consumers to consider.Adds
--gitignoreto the spellcheck script so it stops checking build output. Locally this drops the file count from 15471 to 7942, all of the difference being generated files underbuild/. CI never built, so it was already checking the smaller set; this makes local runs match CI.Drops
--legacy-peer-depsfrom CI and removes the single valuenode_versionmatrix axis.Does this introduce a breaking change?
Other information
Two upgrades change rendering rather than just versions:
modern-normalizev3 dropshr { height: 0 }. Becausetheme.customCssis injected after Infima, that rule was overriding--ifm-hr-heightand flattening every horizontal rule. Rules now render at their intended 1px. This affects the 48 Capacitor plugin pages, which are the only pages in the site containing anhr. Compare the Action Sheet page in production, where the separators between API entries are missing, against the same page in this branch's preview, where they are visible.Anything whose blast radius reaches beyond dependency resolution was deliberately left out, so that each one gets a reviewable diff of its own rather than being buried in this one.
prettier2 to 3 and@ionic/prettier-config3 to 4 move together, since the config package exists to pair with prettier 3. That upgrade reformats every file in the repo, so the diff would be thousands of lines of whitespace with the real changes hidden inside it. It needs a PR where the reformat is the only thing under review.typescript5 to 7 is a compiler major. Nothing typechecks today (tscis in no npm script and not in CI, and the repo has 42 pre-existing errors on both 5.3 and 5.9), so upgrading it means first deciding whether typechecking should be enforced at all. That is a separate conversation from keeping dependencies current.crowdinis deprecated on npm, but the situation is more involved than a version swap. The package ships no binary and is never imported, whilecrowdin.ymlis configured for the official CLI (@crowdin/cli), which is not declared anywhere. The npm deprecation notice points at@crowdin/crowdin-api-client, which is a library with no CLI and would not resolve thecrowdin uploadcommand either. Before changing it, someone needs to confirm how that command currently resolves on Vercel, since it is the path that keeps the Japanese docs in sync.