build(deps): bump webpack from 5.74.0 to 5.110.3 in /docs - #175
build(deps): bump webpack from 5.74.0 to 5.110.3 in /docs#175dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
meta-cla
Bot
added
the
CLA Signed
|
@dependabot rebase |
Bumps [webpack](https://github.com/webpack/webpack) from 5.74.0 to 5.110.3. - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.74.0...v5.110.3) --- updated-dependencies: - dependency-name: webpack dependency-version: 5.105.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
8a43a69 to
e7fc84e
Compare
|
Closing — this cannot be made to work against the current docs stack, and the blocker is not what it first appears. Two independent blockers, not oneThe visible failure was a Node engine error (`node-releases@2.0.54` requires `>=18`, runner pinned to `14.x`). But that was masking the real problem. I isolated the variables on a scratch fork:
So bumping Node does not unblock this PR; it just lets the build reach the real failure. webpack 5.110.3 is incompatible with Rebasing this PR will keep reproducing that failure, so it is not going to converge. On the risk being deferredThe four advisories here — including CVE-2023-28154 (critical) — are build-time only. webpack runs when generating the static site and ships nothing to visitors, so real-world exposure is minimal. The actual fixUpgrading Docusaurus off Thanks Dependabot; reopening this individually will not help until the Docusaurus upgrade lands. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
* Upgrade Docusaurus 2.0.0-beta.5 -> 3.10.2
The docs site was pinned to a 2021 Docusaurus beta, which held the entire
JS dependency tree in place and made most of the docs/yarn.lock security
advisories unfixable individually. Dependabot had been reporting
security_update_not_possible for exactly this reason, e.g.
decode-uri-component could not move past 0.2.0 because
@docusaurus/core@2.0.0-beta.5 required it transitively.
Changes:
- @docusaurus/core and preset-classic 2.0.0-beta.5 -> ^3.10.2
- react/react-dom ^17 -> ^18.3.1, @mdx-js/react ^1 -> ^3 (v3 peer deps)
- clsx ^1 -> ^2, prism-react-renderer added (required by v3 preset)
- dropped @svgr/webpack, file-loader, url-loader and the stray 'yarn'
dependency: all unused here, every svg import in src/ is commented out
- engines.node >=20.0, matching Docusaurus 3's own requirement
- CI node-version 14.x -> 20.x in documentation.yml (14 is EOL, and
Docusaurus 3 will not run on it)
Two config migrations were needed:
markdown.format: 'detect' - MDX v3 is stricter than v1 and tried to
evaluate literal braces in the generated API docs as JSX expressions,
failing on "{ id: string, url: string }" in mapillary.interface.md.
'detect' parses .md as CommonMark and reserves MDX for .mdx. Escaping the
braces instead would have been undone by the next scripts/documentation.py
run, since those files are generated from Python docstrings.
onBrokenMarkdownLinks moved under markdown.hooks, where v3 expects it;
the top-level option is deprecated and removed in v4.
Verified locally on Node 20: build succeeds, 43 HTML pages generated, and
the page that previously failed to compile now renders its braces as
literal text.
Notable transitive results: webpack 5.74.0 -> 5.110.3 (the bump #175
attempted and could not land, since 5.110.3 is incompatible with the
beta), websocket-driver 0.7.4 -> 0.7.5, svgo 1.3.2 -> 3.3.5, browserslist
4.14.2 -> 4.28.9, shell-quote 1.7.2 -> 1.10.0, postcss 8.4.16 -> 8.5.28,
and axios, ua-parser-js and decode-uri-component dropped entirely.
* Add client redirects for the seven doc URLs the upgrade moves
Docusaurus treats a doc whose filename matches its folder as that
category's index page, a convention introduced after 2.0.0-beta.5.
Upgrading therefore shortens seven API doc URLs, e.g.
/docs/mapillary.config/mapillary.config -> /docs/mapillary.config
Nothing in the repo references the old paths and every internal link
regenerates, but external bookmarks and inbound links would 404. This
adds @docusaurus/plugin-client-redirects and maps each old path to its
new one.
Verified by building and following each redirect: all seven stubs are
emitted with the correct target, and the content reached through them
matches what the old URL served. The only differences are chrome the
v3 theme renders differently (prev/next arrows, dark-mode toggle icons).
Build output goes 43 -> 50 pages: 43 real pages plus 7 redirect stubs.
Internal link check still reports 0 unresolvable across 49 links.
docs/tags is intentionally not redirected. It existed in v2 as an empty
tag index with no tags to list; v3 omits it rather than emitting an
empty page.
1 participant
Bumps webpack from 5.74.0 to 5.110.3.
Release notes
Sourced from webpack's releases.
... (truncated)
Changelog
Sourced from webpack's changelog.
... (truncated)
Commits
a2d7b9cchore(release): new release (#21868)d6e86c0test(test262): assert two more errors webpack reports at build time (#21906)6a963fefix: keep require() into a concatenation substituted and unmangled (#21905)e1eb099fix: concatenatedrequire()inrequire.ensurecallback or computed reques...8d1ab53chore: escape literal NUL bytes in Compilation.js (#21904)5e6c4d7fix(defer): evaluate async dependencies where the deferred import sits (#21902)7ea4fa3fix: handle audited correctness edge cases (#21901)c50713cfix: keep code generation data per result instead of per NormalModule (#21900)ebd3be4docs: document the post-minor stabilization week and out-of-band releases (#2...80be700fix(config): keep the resolved optimization.minimize a boolean (#21886)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for webpack since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.