PER-14336: Remediate npm vulnerabilities, update Docusaurus to 3.10.1, and remove unused dependencies by zeevmoney · Pull Request #619 · permitio/docs

zeevmoney · 2026-03-31T16:38:51Z

Summary

Remediate npm vulnerabilities and remove unused dependencies. Production build and link check pass; no source behavior changes.
Remove 9 unused or abnormal dependencies: lodash, ignore-styles, postcss-preset-env, remark-gfm, @babel/register, npm, @svgr/webpack, file-loader, url-loader
Update direct dependencies (axios, Docusaurus ecosystem 3.7.0 → 3.10.1, react-syntax-highlighter, react-code-blocks); remove the Playwright/Argos visual-regression setup; add npm overrides for transitive vulnerabilities
Add Dependabot configuration for weekly npm + GitHub Actions updates; remove the stale packageManager yarn field

Linear Issue

PER-14336

What changed

Removed unused dependencies

Package	Reason
`lodash`	No imports in source code — transitive deps have their own copies
`ignore-styles`	Zero references anywhere in the codebase
`postcss-preset-env`	Not in any PostCSS config — only tailwindcss + autoprefixer are used
`remark-gfm`	Docusaurus 3.x has built-in GFM support
`@babel/register`	Commented out in docusaurus.config.js
`npm`	Abnormal production dependency
`@svgr/webpack`	No SVG-as-component imports (SVGs are used as URL strings); Docusaurus core bundles its own copy
`file-loader`	No webpack config references it; Docusaurus 3 (webpack 5) uses native asset modules
`url-loader`	No webpack config references it; same as `file-loader`

Direct dependency updates

Package	From	To	Fixes
`axios`	^1.8.4	1.16.1 (pinned)	DoS, supply chain risk
`@docusaurus/*` (7 pkgs)	^3.7.0	^3.10.1	convict, serialize-js, node-forge, undici, etc.
`react-syntax-highlighter`	^15.6.1	^16.1.1	prismjs XSS/DOM clobbering
`react-code-blocks`	^0.0.9-0	^0.1.6	—

Removed test infrastructure

Deleted the Playwright/Argos visual-regression harness (playwright.config.js, tests/screenshot.spec.js, tests/screenshot.css) and dropped @playwright/test and @argos-ci/*. Removes the @playwright/test CVE surface. The Argos CI job was removed separately.

Infrastructure

.github/dependabot.yml — weekly npm + GitHub Actions update scanning
ajv@8.18.0 as a devDependency — forces ajv@8 to the hoisted root so schema-utils@4 (the webpack loaders under Docusaurus) resolves correctly. Without it, older loaders pull ajv@6 to the root and the build can fail with Cannot find module 'ajv/dist/compile/codegen'.
npm overrides for: got, serialize-javascript, cross-spawn, picomatch, minimatch, webpackbar
Applied npm audit fix (semver-safe) to clear remaining high-severity transitive advisories
Removed stale packageManager: yarn@1.22.22 field (no yarn.lock exists)

Remaining vulnerabilities (23 moderate, 0 high, 0 critical)

All trace to two transitive roots with no available fix:

uuid (buffer bounds, GHSA-w5hq-g745-h8pq) → sockjs → webpack-dev-server → the @docusaurus/* packages. Dev-server only (docusaurus start); never ships to the static site.
prismjs (<1.30.0 DOM clobbering) → refractor → react-syntax-highlighter → react-code-blocks. No upstream fix; used to render code blocks.

Test plan

docusaurus build — production build succeeds on Docusaurus 3.10.1
npm run hyperlink — 0 bad links, 0 bad anchors across 2392 files (503 documents)
npm audit — 0 critical, 0 high, 23 moderate (all unfixable transitive)
Local browse (homepage, code-block page, Mermaid page) — render correctly, no console errors
Removed packages have zero references in source code
Visual regression test on staging deployment

Tests

Build verification (production build + link check + local browse)
Unit tests: N/A (dependency updates only, no source code changes)

Generated with Claude Code

Automated iterations

(at commit 601e5d9)

[LOW] Removed the dead node-forge: ">=1.4.0" override from package.json. node-forge dropped out of the dependency tree after the @docusaurus bump and unused-dependency removal (absent from package-lock.json), so the override no longer remediated anything. Lockfile unchanged.

Verified clean (no change needed): the Dependabot dependency-type: "development" group is valid per the GitHub Dependabot options reference (supported for npm); all other overrides (got, serialize-javascript, cross-spawn, picomatch, minimatch, webpackbar) are present in the lockfile and satisfy their constraints; Playwright was removed cleanly with no dangling references.

No HIGH/CRITICAL findings.

- Remove `npm` from production dependencies (~25 vulns eliminated) - Update axios 1.8.4 → 1.14.0 (pinned, fixes DoS CVE-2026-25639) - Update lodash 4.17.21 → 4.17.23 (pinned, fixes prototype pollution) - Update @playwright/test 1.50.0 → 1.58.2 (fixes SSL cert bypass) - Update all @docusaurus/* packages 3.7.0 → 3.9.2 - Update react-syntax-highlighter 15.6.1 → 16.1.1 (fixes prismjs XSS) - Update react-code-blocks 0.0.9-0 → 0.1.6 - Add npm overrides for transitive vulns (serialize-javascript, node-forge, cross-spawn, picomatch, minimatch) - Add ajv@8 + ajv-formats as devDependencies to fix schema-utils@4 compat - Remove stale packageManager field (yarn@1.22.22 with no yarn.lock) - Add .github/dependabot.yml for automated npm + GH Actions updates Remaining 10 vulns are in @untitaker/hyperlink (dev-only) and react-code-blocks (bundled prismjs, no upstream fix available). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

linear · 2026-03-31T16:38:54Z

PER-14336 Security: Remediate 97 npm vulnerabilities in docs repository

netlify · 2026-03-31T16:38:57Z

✅ Deploy Preview for permitio-docs ready!

Name	Link
🔨 Latest commit	`24f3898`
🔍 Latest deploy log	https://app.netlify.com/projects/permitio-docs/deploys/6a1ef27b1a6cb90008cbabba
😎 Deploy Preview	https://deploy-preview-619--permitio-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

- lodash: no imports in source code (transitive deps have own copies) - ignore-styles: zero references in codebase - postcss-preset-env: not in any PostCSS config (only tailwindcss/autoprefixer used) - remark-gfm: Docusaurus 3.x has built-in GFM support - @babel/register: commented out in docusaurus.config.js Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

This PR reduces npm security vulnerabilities and simplifies the dependency graph by upgrading key packages, removing unused/abnormal dependencies, adding npm overrides for vulnerable transitive deps, and introducing Dependabot for ongoing automated updates.

Changes:

Upgraded Docusaurus, axios, Playwright, and code-highlighting packages; removed several unused dependencies.
Added npm overrides entries to remediate vulnerable transitive dependencies.
Added .github/dependabot.yml to enable weekly npm and GitHub Actions update scanning.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
package.json	Dependency upgrades/removals plus new npm `overrides` and devDependency additions.
.github/dependabot.yml	Adds weekly Dependabot update configuration for npm and GitHub Actions.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Newer @argos-ci/core no longer auto-detects the GitHub token and requires an explicit ARGOS_TOKEN secret. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

argos-ci · 2026-04-09T10:37:36Z

The latest updates on your projects. Learn more about Argos notifications ↗︎

Awaiting the start of a new Argos build…

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Resolve conflicts with master (#622 removed argos.yml, #621 added webpackbar override). Drop all Argos infrastructure now that visual regression CI is gone: @argos-ci/cli, @argos-ci/playwright, @playwright/test, the tests/ directory, playwright.config.js, and Playwright .gitignore entries. Keep PER-14336 security overrides (serialize-javascript, node-forge, cross-spawn, picomatch, minimatch) and add the new webpackbar override from master. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…nto per-14336/remediate-npm-vulns * origin/per-14336/remediate-npm-vulns:

node-forge is no longer in the dependency tree after the @Docusaurus 3.9.2 bump and unused-dependency removal — it is absent from package-lock.json, so the `node-forge: ">=1.4.0"` override no longer remediates anything. Removing it (lockfile unchanged on npm install). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

zeevmoney · 2026-06-02T14:30:53Z

@copilot please re-review the latest changes (commit 601e5d9).

Copilot · 2026-06-02T14:36:27Z

@copilot please re-review the latest changes (commit 601e5d9).

Re-reviewed 601e5d9: the node-forge override removal is correct (no node-forge remains in package.json or package-lock.json). I also re-ran npm run build (including hyperlink) successfully. No further changes are needed.

Bump @docusaurus/* 3.9.2 -> 3.10.1 and pin axios 1.16.1. Remove @svgr/webpack, file-loader, url-loader, and ajv-formats, which have no references in source or webpack config and are not consumed by the dependency tree. Apply npm audit fix to clear remaining high-severity transitive advisories. Build, hyperlink check, and local browse pass; remaining audit findings are 23 moderate from two unfixable transitive roots (uuid via webpack-dev-server, prismjs via react-code-blocks). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

zeevmoney changed the title ~~PER-14336: Remediate npm vulnerabilities (97→10)~~ PER-14336: Remediate npm vulnerabilities (97→10) and remove unused dependencies Mar 31, 2026

zeevmoney marked this pull request as ready for review April 3, 2026 17:29

Copilot AI review requested due to automatic review settings April 3, 2026 17:29

Copilot started reviewing on behalf of zeevmoney April 3, 2026 17:29 View session

Copilot AI reviewed Apr 3, 2026

View reviewed changes

Comment thread .github/dependabot.yml

Comment thread package.json

Fix Argos CI upload by passing ARGOS_TOKEN explicitly

fed30f8

Newer @argos-ci/core no longer auto-detects the GitHub token and requires an explicit ARGOS_TOKEN secret. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

zeevmoney and others added 5 commits April 9, 2026 13:39

Remove dead lodash import from list-role-assignments.mdx

ad4ee8d

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Merge branch 'master' into per-14336/remediate-npm-vulns

bb88920

Merge remote-tracking branch 'origin/per-14336/remediate-npm-vulns' i…

5d46710

…nto per-14336/remediate-npm-vulns * origin/per-14336/remediate-npm-vulns:

Copilot started work on behalf of zeevmoney June 2, 2026 14:31 View session

Copilot finished work on behalf of zeevmoney June 2, 2026 14:36

Merge branch 'master' into per-14336/remediate-npm-vulns

854f964

zeevmoney requested review from CarlosMion, EliMoshkovich, Zivxx, dshoen619, omer9564 and shuvyA June 2, 2026 14:51

omer9564 approved these changes Jun 2, 2026

View reviewed changes

EliMoshkovich approved these changes Jun 2, 2026

View reviewed changes

omer9564 approved these changes Jun 2, 2026

View reviewed changes

Comment thread docs/how-to/enforce-permissions/list-role-assignments.mdx

Comment thread tests/screenshot.css Outdated

Comment thread tests/screenshot.spec.js Outdated

Comment thread package.json Outdated

zeevmoney changed the title ~~PER-14336: Remediate npm vulnerabilities (97→10) and remove unused dependencies~~ PER-14336: Remediate npm vulnerabilities, update Docusaurus to 3.10.1, and remove unused dependencies Jun 2, 2026

zeevmoney merged commit a838852 into master Jun 2, 2026
4 checks passed

zeevmoney deleted the per-14336/remediate-npm-vulns branch June 2, 2026 15:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PER-14336: Remediate npm vulnerabilities, update Docusaurus to 3.10.1, and remove unused dependencies#619

PER-14336: Remediate npm vulnerabilities, update Docusaurus to 3.10.1, and remove unused dependencies#619
zeevmoney merged 10 commits into
masterfrom
per-14336/remediate-npm-vulns

zeevmoney commented Mar 31, 2026 •

edited

Loading

Uh oh!

linear Bot commented Mar 31, 2026

Uh oh!

netlify Bot commented Mar 31, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

argos-ci Bot commented Apr 9, 2026 •

edited

Loading

Uh oh!

zeevmoney commented Jun 2, 2026

Uh oh!

Copilot AI commented Jun 2, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

zeevmoney commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linear Issue

What changed

Removed unused dependencies

Direct dependency updates

Removed test infrastructure

Infrastructure

Remaining vulnerabilities (23 moderate, 0 high, 0 critical)

Test plan

Tests

Automated iterations

Uh oh!

linear Bot commented Mar 31, 2026

Uh oh!

netlify Bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for permitio-docs ready!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

argos-ci Bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zeevmoney commented Jun 2, 2026

Uh oh!

Copilot AI commented Jun 2, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

zeevmoney commented Mar 31, 2026 •

edited

Loading

netlify Bot commented Mar 31, 2026 •

edited

Loading

argos-ci Bot commented Apr 9, 2026 •

edited

Loading