Skip to content

Commit d810018

Browse files
fix(docs): remove unbounded path-to-regexp override breaking SSG (#1153)
## Description Removed the `"path-to-regexp": ">=1.9.0"` npm override from the Docusaurus project. The unbounded lower bound resolved to **path-to-regexp v8.3.0** in CI, which only exposes named exports — breaking `react-router@5.3.4`'s default import and crashing SSG with a `TypeError` during `docusaurus build`. > The override was originally added for CVE remediation but became incompatible when v8.x dropped the default export that react-router depends on. Each transitive consumer now resolves its own compatible version through npm's nested `node_modules`: | Consumer | Resolved Version | |---|---| | *react-router* | 1.9.0 | | *serve-handler* | 3.3.0 | | *express* | 0.1.12 | No new direct dependencies were introduced. The remaining overrides (*express*, *minimatch*, *serialize-javascript*, *undici*) are unchanged. ## Related Issue(s) None ## Type of Change Select all that apply: **Code & Documentation:** * [x] Bug fix (non-breaking change fixing an issue) * [ ] New feature (non-breaking change adding functionality) * [ ] Breaking change (fix or feature causing existing functionality to change) * [ ] Documentation update **Infrastructure & Configuration:** * [ ] GitHub Actions workflow * [ ] Linting configuration (markdown, PowerShell, etc.) * [ ] Security configuration * [ ] DevContainer configuration * [x] Dependency update **AI Artifacts:** * [ ] Reviewed contribution with `prompt-builder` agent and addressed all feedback * [ ] Copilot instructions (`.github/instructions/*.instructions.md`) * [ ] Copilot prompt (`.github/prompts/*.prompt.md`) * [ ] Copilot agent (`.github/agents/*.agent.md`) * [ ] Copilot skill (`.github/skills/*/SKILL.md`) **Other:** * [ ] Script/automation (`.ps1`, `.sh`, `.py`) * [ ] Other (please describe): ## Sample Prompts (for AI Artifact Contributions) <!-- No AI artifact changes in this PR --> ## Testing - **Docusaurus build**: `npm run build` completed without errors in `docs/docusaurus/` — SSG generated all static pages successfully. - **Docusaurus tests**: `npm test` passed 42/42 in `docs/docusaurus/`. - **Dependency audit**: `npm audit` reported 0 vulnerabilities. - **Dependency tree**: `npm ls path-to-regexp` confirmed correct nested resolution (1.9.0, 3.3.0, 0.1.12). - **Security analysis**: No sensitive data exposure, no privilege changes, no new direct dependencies. - Manual testing was not performed. ## Checklist ### Required Checks * [ ] Documentation is updated (if applicable) (N/A — no documentation changes required) * [x] Files follow existing naming conventions * [x] Changes are backwards compatible (if applicable) * [ ] Tests added for new functionality (if applicable) (N/A — bug fix, no new functionality) ### AI Artifact Contributions <!-- Not applicable — no AI artifact changes --> ### Required Automated Checks The following validation commands must pass before merging: * [x] Markdown linting: `npm run lint:md` * [x] Spell checking: `npm run spell-check` * [x] Frontmatter validation: `npm run lint:frontmatter` * [x] Skill structure validation: `npm run validate:skills` * [ ] Link validation: `npm run lint:md-links` (skipped per user request) * [x] PowerShell analysis: `npm run lint:ps` * [x] Plugin freshness: `npm run plugin:generate` ## Security Considerations * [x] This PR does not contain any sensitive or NDA information * [x] Any new dependencies have been reviewed for security issues * [ ] Security-related scripts follow the principle of least privilege (N/A — no security scripts modified) ## Additional Notes - The five most recent `deploy-docs` workflow runs on `main` failed with the same `path-to-regexp` default-export `TypeError`. This fix restores CI builds. - The remaining `>=` overrides in `package.json` could exhibit similar breakage if major versions drop expected APIs. Consider pinning to specific major ranges (e.g., `^4.21.2` instead of `>=4.21.2`) in a follow-up.
1 parent 06f826c commit d810018

File tree

2 files changed

+27
-11
lines changed

2 files changed

+27
-11
lines changed

docs/docusaurus/package-lock.json

Lines changed: 27 additions & 10 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

docs/docusaurus/package.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,6 @@
5858
"overrides": {
5959
"express": ">=4.21.2",
6060
"minimatch": ">=3.1.3",
61-
"path-to-regexp": ">=1.9.0",
6261
"serialize-javascript": ">=7.0.3",
6362
"undici": ">=7.24.1"
6463
}

0 commit comments

Comments
 (0)