Skip to content

[Snyk] Security upgrade @docusaurus/theme-mermaid from 2.4.0 to 3.5.0#175

Open
naiba4 wants to merge 1 commit into
mainfrom
snyk-fix-e6c8e311a99bdf9bf4d6f067c83d5612
Open

[Snyk] Security upgrade @docusaurus/theme-mermaid from 2.4.0 to 3.5.0#175
naiba4 wants to merge 1 commit into
mainfrom
snyk-fix-e6c8e311a99bdf9bf4d6f067c83d5612

Conversation

@naiba4

@naiba4 naiba4 commented Nov 8, 2025

Copy link
Copy Markdown
Owner

snyk-top-banner

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

  • package.json
  • package-lock.json

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Origin Validation Error
SNYK-JS-WEBPACKDEVSERVER-10300775
  142  
medium severity Exposed Dangerous Method or Function
SNYK-JS-WEBPACKDEVSERVER-10300777
  129  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

@changeset-bot

changeset-bot Bot commented Nov 8, 2025

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: f541cff

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@guardrails

guardrails Bot commented Nov 8, 2025

Copy link
Copy Markdown

⚠️ We detected 4 security issues in this pull request:

Vulnerable Libraries (4)
Severity Details
Medium pkg:npm/markdown-to-jsx@7.1.7 (t) upgrade to: 7.4.0
Critical pkg:npm/vercel@28.18.5 (t) upgrade to: > 28.18.5
Medium pkg:npm/@babel/eslint-parser@7.19.1 (t) upgrade to: > 7.19.1
High pkg:npm/@docusaurus/theme-mermaid@3.5.0 upgrade to: > 3.5.0

More info on how to fix Vulnerable Libraries in JavaScript.


👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​docusaurus/​theme-mermaid@​2.4.0 ⏵ 3.5.0100 +110076 +199 +1100
Updatedautoprefixer@​10.4.14 ⏵ 10.4.21100 +110092 +179100

View full report

@socket-security

Copy link
Copy Markdown

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Medium
Trivial package: npm @babel/plugin-transform-react-jsx-development has 8 lines of code

Location: Package overview

From: package-lock.jsonnpm/@docusaurus/core@2.4.0npm/@docusaurus/plugin-ideal-image@2.4.0npm/@docusaurus/preset-classic@2.4.0npm/@docusaurus/plugin-content-blog@2.4.0npm/@docusaurus/theme-mermaid@3.5.0npm/@babel/plugin-transform-react-jsx-development@7.27.1

ℹ Read more on: This package | This alert | What are trivial packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/plugin-transform-react-jsx-development@7.27.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm config-chain in module http

Module: http

Location: Package overview

From: package-lock.jsonnpm/@docusaurus/theme-mermaid@3.5.0npm/config-chain@1.1.13

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/config-chain@1.1.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm svgo in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: package-lock.jsonnpm/@docusaurus/theme-mermaid@3.5.0npm/svgo@3.3.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/svgo@3.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Environment variable access: npm @babel/code-frame reads FORCE_COLOR

Env Vars: FORCE_COLOR

Location: Package overview

From: package-lock.jsonnpm/@babel/eslint-parser@7.19.1npm/@docusaurus/core@2.4.0npm/@docusaurus/plugin-ideal-image@2.4.0npm/@docusaurus/preset-classic@2.4.0npm/@docusaurus/plugin-content-blog@2.4.0npm/@docusaurus/theme-mermaid@3.5.0npm/@babel/code-frame@7.27.1

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/code-frame@7.27.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @babel/core is 100.0% likely to have a medium risk anomaly

Notes: The analyzed fragment implements a conventional file transformation entry point with no evident malicious behavior or hard-coded secrets. Security concerns depend on the downstream transformation logic (run) and configuration loading (loadConfig). The code maintains safe control flow (null config handling) and avoids arbitrary code execution within this scope.

Confidence: 1.00

Severity: 0.60

From: package-lock.jsonnpm/@babel/eslint-parser@7.19.1npm/@docusaurus/core@2.4.0npm/@docusaurus/plugin-ideal-image@2.4.0npm/@docusaurus/preset-classic@2.4.0npm/@docusaurus/plugin-content-blog@2.4.0npm/@docusaurus/theme-mermaid@3.5.0npm/@babel/core@7.28.5

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/core@7.28.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Environment variable access: npm @babel/helper-compilation-targets reads BROWSERSLIST

Env Vars: BROWSERSLIST

Location: Package overview

From: package-lock.jsonnpm/@babel/eslint-parser@7.19.1npm/@docusaurus/core@2.4.0npm/@docusaurus/plugin-ideal-image@2.4.0npm/@docusaurus/preset-classic@2.4.0npm/@docusaurus/plugin-content-blog@2.4.0npm/@docusaurus/theme-mermaid@3.5.0npm/@babel/helper-compilation-targets@7.27.2

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/helper-compilation-targets@7.27.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Environment variable access: npm @babel/helper-compilation-targets reads BROWSERSLIST_CONFIG

Env Vars: BROWSERSLIST_CONFIG

Location: Package overview

From: package-lock.jsonnpm/@babel/eslint-parser@7.19.1npm/@docusaurus/core@2.4.0npm/@docusaurus/plugin-ideal-image@2.4.0npm/@docusaurus/preset-classic@2.4.0npm/@docusaurus/plugin-content-blog@2.4.0npm/@docusaurus/theme-mermaid@3.5.0npm/@babel/helper-compilation-targets@7.27.2

ℹ Read more on: This package | This alert | What is environment variable access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/helper-compilation-targets@7.27.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Embedded URLs or IPs: npm @babel/helper-create-class-features-plugin

URLs: https://github.com/babel/babel/issues, key.id

Location: Package overview

From: package-lock.jsonnpm/@docusaurus/core@2.4.0npm/@docusaurus/plugin-ideal-image@2.4.0npm/@docusaurus/preset-classic@2.4.0npm/@docusaurus/plugin-content-blog@2.4.0npm/@docusaurus/theme-mermaid@3.5.0npm/@babel/helper-create-class-features-plugin@7.28.5

ℹ Read more on: This package | This alert | What are URL strings?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/helper-create-class-features-plugin@7.28.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @babel/helper-module-imports is 100.0% likely to have a medium risk anomaly

Notes: The analyzed code is a Babel AST helper (ImportBuilder) used to construct import statements and interop-wrapped imports. It contains no indicators of malicious behavior, data exfiltration, backdoors, or runtime abuses. It operates within a compiler/transpiler context to produce code, not to execute arbitrary user data. Therefore, the code itself does not present security risks or malware indicators under normal usage. This is benign library behavior intended for code transformation.

Confidence: 1.00

Severity: 0.60

From: package-lock.jsonnpm/@babel/eslint-parser@7.19.1npm/@docusaurus/core@2.4.0npm/@docusaurus/plugin-ideal-image@2.4.0npm/@docusaurus/preset-classic@2.4.0npm/@docusaurus/plugin-content-blog@2.4.0npm/@docusaurus/theme-mermaid@3.5.0npm/@babel/helper-module-imports@7.27.1

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/helper-module-imports@7.27.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @babel/helper-module-transforms is 100.0% likely to have a medium risk anomaly

Notes: The code is a legitimate, static-code transformation utility used in Babel to ensure proper behavior of ES module bindings after transforms. There is no evidence of malicious behavior, data leakage, or external communications within this fragment. It operates purely on AST-level transformations consistent with module import/export handling.

Confidence: 1.00

Severity: 0.60

From: package-lock.jsonnpm/@babel/eslint-parser@7.19.1npm/@docusaurus/core@2.4.0npm/@docusaurus/plugin-ideal-image@2.4.0npm/@docusaurus/preset-classic@2.4.0npm/@docusaurus/plugin-content-blog@2.4.0npm/@docusaurus/theme-mermaid@3.5.0npm/@babel/helper-module-transforms@7.28.3

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/helper-module-transforms@7.28.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @babel/helper-string-parser is 100.0% likely to have a medium risk anomaly

Notes: The analyzed code is a standard, well-structured parsing utility for JavaScript string literals and escapes (consistent with Babel’s helper-string-parser). It includes thorough validation, proper Unicode handling, and defensive error reporting. There is no evidence of malicious behavior, data leakage, or network activity within this fragment. The security risk is low when used as part of a trusted toolchain; the code otherwise poses no evident supply-chain threat based on the provided snippet.

Confidence: 1.00

Severity: 0.60

From: package-lock.jsonnpm/@babel/eslint-parser@7.19.1npm/@docusaurus/core@2.4.0npm/@docusaurus/plugin-ideal-image@2.4.0npm/@docusaurus/preset-classic@2.4.0npm/@docusaurus/plugin-content-blog@2.4.0npm/@docusaurus/theme-mermaid@3.5.0npm/@babel/helper-string-parser@7.27.1

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/helper-string-parser@7.27.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Embedded URLs or IPs: npm @babel/helpers

URLs: body.0.id, body.1.id, body.0.declarations.0.id, body.2.id, body.3.id, body.4.id, body.5.id, body.6.id, body.7.id, https://github.com/babel/babel/blob/main/packages/babel-helpers/LICENSE, body.8.id, body.9.id, body.10.id, body.11.id, body.12.id, body.13.id, body.1.declarations.0.id

Location: Package overview

From: package-lock.jsonnpm/@babel/eslint-parser@7.19.1npm/@docusaurus/core@2.4.0npm/@docusaurus/plugin-ideal-image@2.4.0npm/@docusaurus/preset-classic@2.4.0npm/@docusaurus/plugin-content-blog@2.4.0npm/@docusaurus/theme-mermaid@3.5.0npm/@babel/helpers@7.28.4

ℹ Read more on: This package | This alert | What are URL strings?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/helpers@7.28.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @babel/helpers is 100.0% likely to have a medium risk anomaly

Notes: The analyzed fragment is a conventional Babel/TypeScript-style decorators runtime (applyDecs) responsible for applying decorators to class members and managing metadata and initializers. There is no evidence of malware, backdoors, or external data leakage within this module. While complex, the code behaves as a metadata-driven decorator processor and should be considered low risk when used as intended. Downstream risks depend on the decorators provided by consumers, not this utility itself.

Confidence: 1.00

Severity: 0.60

From: package-lock.jsonnpm/@babel/eslint-parser@7.19.1npm/@docusaurus/core@2.4.0npm/@docusaurus/plugin-ideal-image@2.4.0npm/@docusaurus/preset-classic@2.4.0npm/@docusaurus/plugin-content-blog@2.4.0npm/@docusaurus/theme-mermaid@3.5.0npm/@babel/helpers@7.28.4

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/helpers@7.28.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @babel/plugin-syntax-typescript is 100.0% likely to have a medium risk anomaly

Notes: The code is a standard Babel plugin fragment that configures syntax support for TypeScript by manipulating parser plugins. There is no malicious logic, no data exfiltration, and no unsafe operations. It appears to be a legitimate helper for enabling TypeScript syntax in Babel pipelines.

Confidence: 1.00

Severity: 0.60

From: package-lock.jsonnpm/@docusaurus/core@2.4.0npm/@docusaurus/plugin-ideal-image@2.4.0npm/@docusaurus/preset-classic@2.4.0npm/@docusaurus/plugin-content-blog@2.4.0npm/@docusaurus/theme-mermaid@3.5.0npm/@babel/plugin-syntax-typescript@7.27.1

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/plugin-syntax-typescript@7.27.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Embedded URLs or IPs: npm @babel/plugin-transform-class-static-block with key.id

URLs: key.id

Location: Package overview

From: package-lock.jsonnpm/@docusaurus/core@2.4.0npm/@docusaurus/plugin-ideal-image@2.4.0npm/@docusaurus/preset-classic@2.4.0npm/@docusaurus/plugin-content-blog@2.4.0npm/@docusaurus/theme-mermaid@3.5.0npm/@babel/plugin-transform-class-static-block@7.28.3

ℹ Read more on: This package | This alert | What are URL strings?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/plugin-transform-class-static-block@7.28.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Embedded URLs or IPs: npm @docusaurus/core

URLs: 0.0.0.0, https://example.com, http://www.w3.org/2000/svg, github.io, github.com, https://docusaurus.io/docs/docusaurus-core/#browseronly, https://docusaurus.io/docs/docusaurus-core/#executionenvironment

Location: Package overview

From: package-lock.jsonnpm/@docusaurus/theme-mermaid@3.5.0npm/@docusaurus/core@3.5.0

ℹ Read more on: This package | This alert | What are URL strings?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@docusaurus/core@3.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Embedded URLs or IPs: npm @docusaurus/mdx-loader

URLs: https://github.com/facebook/docusaurus/pull/9394

Location: Package overview

From: package-lock.jsonnpm/@docusaurus/theme-mermaid@3.5.0npm/@docusaurus/mdx-loader@3.5.0

ℹ Read more on: This package | This alert | What are URL strings?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@docusaurus/mdx-loader@3.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Embedded URLs or IPs: npm @docusaurus/theme-common

URLs: https://www.unicode.org/cldr/cldr-aux/charts/34/supplemental/language_plural_rules.html, docusaurus.announcement.id, https://docusaurus.io/docs/api/themes/configuration#use-color-mode

Location: Package overview

From: package-lock.jsonnpm/@docusaurus/theme-mermaid@3.5.0npm/@docusaurus/theme-common@3.5.0

ℹ Read more on: This package | This alert | What are URL strings?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@docusaurus/theme-common@3.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Filesystem access: npm @docusaurus/utils-validation with module fs-extra

Module: fs-extra

Location: Package overview

From: package-lock.jsonnpm/@docusaurus/theme-mermaid@3.5.0npm/@docusaurus/utils-validation@3.5.0

ℹ Read more on: This package | This alert | What is filesystem access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@docusaurus/utils-validation@3.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Embedded URLs or IPs: npm @docusaurus/utils

URLs: https://domain.com, https://example.com

Location: Package overview

From: package-lock.jsonnpm/@docusaurus/theme-mermaid@3.5.0npm/@docusaurus/utils@3.5.0

ℹ Read more on: This package | This alert | What are URL strings?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@docusaurus/utils@3.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Embedded URLs or IPs: npm @mdx-js/mdx

URLs: https://mdxjs.com/migrating/v2/, https://mdxjs.com/migrating/v3/

Location: Package overview

From: package-lock.jsonnpm/@docusaurus/theme-mermaid@3.5.0npm/@mdx-js/mdx@3.1.1

ℹ Read more on: This package | This alert | What are URL strings?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mdx-js/mdx@3.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Embedded URLs or IPs: npm @pnpm/npm-conf

URLs: https://github.com/pnpm/pnpm/issues/4203#issuecomment-1133872769, npm.pkg.github.com/:_authToken, npm.pkg.github.com/:_authtoken, npm.pkg.github.com/:_auth, npm.pkg.github.com/:_always_auth, npm.pkg.github.com/:_always-auth, https://registry.npmjs.org/

Location: Package overview

From: package-lock.jsonnpm/@docusaurus/theme-mermaid@3.5.0npm/@pnpm/npm-conf@2.3.1

ℹ Read more on: This package | This alert | What are URL strings?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@pnpm/npm-conf@2.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Filesystem access: npm @pnpm/npm-conf with module fs

Module: fs

Location: Package overview

From: package-lock.jsonnpm/@docusaurus/theme-mermaid@3.5.0npm/@pnpm/npm-conf@2.3.1

ℹ Read more on: This package | This alert | What is filesystem access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@pnpm/npm-conf@2.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 57 more rows in the dashboard

View full report

@openzeppelin-code

Copy link
Copy Markdown

[Snyk] Security upgrade @docusaurus/theme-mermaid from 2.4.0 to 3.5.0

Generated at commit: f541cffc01e7e211eceb9b5942ab9a1b4cbcfe05

🚨 Report Summary

Severity Level Results
Contracts Critical
High
Medium
Low
Note
Total
0
0
0
0
0
0
Dependencies Critical
High
Medium
Low
Note
Total
0
0
0
0
0
0

For more details view the full report in OpenZeppelin Code Inspector

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants