[Snyk] Security upgrade nextra from 2.2.16 to 3.2.4 - #8
Conversation
…rabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230
There was a problem hiding this comment.
Pull Request Overview
This PR upgrades the nextra package from version 2.2.16 to 3.2.4 to address a high-severity Regular Expression Denial of Service (ReDoS) vulnerability (SNYK-JS-CROSSSPAWN-8303230) in the cross-spawn dependency with a severity score of 756.
Key changes:
- Major version upgrade of
nextrafrom 2.x to 3.x (a breaking change release) - Security fix for ReDoS vulnerability in transitive dependency
Reviewed Changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| website/package.json | Updates nextra dependency from ^2.2.16 to ^3.2.4, but leaves nextra-theme-docs at 2.2.16 which may cause compatibility issues |
| website/package-lock.json | Lockfile updates for the nextra package upgrade and its dependencies |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "next-sitemap": "^4.0.0", | ||
| "nextra": "^2.2.16", | ||
| "nextra": "^3.2.4", | ||
| "nextra-theme-docs": "^2.2.16", |
There was a problem hiding this comment.
Upgrading nextra from 2.2.16 to 3.2.4 is a major version upgrade, but nextra-theme-docs remains at version 2.2.16 on line 26. Nextra 3.x requires a compatible version of nextra-theme-docs (version 3.x).
This version mismatch will likely cause compatibility issues since:
- The codebase imports from both packages (e.g.,
DocsThemeConfigfromnextra-theme-docsin theme.config.tsx) - Nextra 3.x introduced breaking changes to the theme API
Recommendation: Update nextra-theme-docs to ^3.2.4 to match the nextra version.
| "nextra-theme-docs": "^2.2.16", | |
| "nextra-theme-docs": "^3.2.4", |
Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
website/package.jsonwebsite/package-lock.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-CROSSSPAWN-8303230
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Regular Expression Denial of Service (ReDoS)