Skip to content

Commit 3176dab

Browse files
FrooodleFrooodle
authored
chore: deps upgrade + Docusaurus 3.10 hardening (#112)
* chore: deps upgrade + Docusaurus 3.10 hardening Upgrades: - Docusaurus core/preset/theme-search-algolia 3.6.3 -> ^3.10.0 - @docusaurus/module-type-aliases ^3.10.0 - @mdx-js/react 3.0.0 -> ^3.1.1 - posthog-docusaurus ^2.0.5, clsx ^2.1.1, prism-react-renderer ^2.4.1 - Node engine >=16.14 -> >=20.0 (Docusaurus 3.9 dropped Node 18) Vulnerabilities: 40 (4 low, 26 moderate, 10 high) -> 0 via: - Docusaurus 3.10 cascade - npm overrides for serialize-javascript ^7.0.5 (high-sev RCE/XSS in deep copy-webpack-plugin / css-minimizer-webpack-plugin transitives) - npm override for webpackbar ^7.0.0 (v6 used pre-strict ProgressPlugin schema, broke build under newer webpack) New Docusaurus features adopted: - @docusaurus/faster (Rspack/SWC/LightningCSS) via future.faster + the required future.v4.removeLegacyPostBuildHeadAttribute flag - storage namespace to avoid localStorage collisions across versioned docs - onBrokenAnchors: throw (CI safety net for cross-references) - sitemap lastmod from git, drop priority/changefreq (v4 default, SEO win) - colorMode.respectPrefersColorScheme (auto follow OS dark/light) - markdown.hooks.onBrokenMarkdownLinks (replaces deprecated top-level) Cleanups uncovered by Faster: - Deleted babel.config.js (SWC handles JS now; build emitted notice) - Moved scarf tracking pixel from headTags to an inline plugin using injectHtmlTags -> postBodyTags. The <img> in <head> was invalid HTML5 and produced 128 HTML minifier warnings under the strict SWC minifier (browsers tolerated it, tracking still fired). Now warning-free. v4 prep: - :::caution -> :::warning in docs/Server-Admin-Onboarding.md (2 places) * ci: bump Node 18 -> 24 (latest LTS) and update GH Actions - node-version: 18 -> 24 (latest LTS as of Apr 2026) Required: serialize-javascript ^7.0.5 (security override) uses the global crypto API which only exists in Node 19+, so the prior Node 18 runner failed with "ReferenceError: crypto is not defined" - actions/checkout@v3 -> v4 - actions/setup-node@v3 -> v4 Both v3 actions were on the deprecated Node 20 runtime - peaceiris/actions-gh-pages@v3 -> v4 package.json engines stays >=20.0 (Docusaurus 3.10's floor) so users running 20/22/24 locally remain supported; CI just runs latest LTS. * chore: pin engines.node to 24.x (latest LTS) Vercel was emitting two warnings on every deploy: - "engines >=20.0 ... will automatically upgrade when a new major Node.js Version is released" - "Node.js Version defined in your Project Settings (22.x) will not apply, Node.js Version 24.x will be used instead" Open-ended ranges trigger Vercel's auto-upgrade behaviour. Pin to 24.x to match CI and the runtime Vercel is already selecting. Heads-up: the Vercel Project Settings still need to be flipped from 22.x to 24.x to clear the second warning.
1 parent 6fd83d3 commit 3176dab

7 files changed

Lines changed: 5461 additions & 3823 deletions

File tree

‎.github/workflows/deploy.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,10 @@ jobs:
1515
name: Deploy to GitHub Pages
1616
runs-on: ubuntu-latest
1717
steps:
18-
- uses: actions/checkout@v3
19-
- uses: actions/setup-node@v3
18+
- uses: actions/checkout@v4
19+
- uses: actions/setup-node@v4
2020
with:
21-
node-version: 18
21+
node-version: 24
2222
cache: npm
2323

2424
- name: Install dependencies
@@ -31,7 +31,7 @@ jobs:
3131
# Popular action to deploy to GitHub Pages:
3232
# Docs: https://github.com/peaceiris/actions-gh-pages#%EF%B8%8F-docusaurus
3333
- name: Deploy to GitHub Pages
34-
uses: peaceiris/actions-gh-pages@v3
34+
uses: peaceiris/actions-gh-pages@v4
3535
with:
3636
github_token: ${{ secrets.GITHUB_TOKEN }}
3737
# Build output to publish to the `gh-pages` branch:

‎.github/workflows/test-deploy.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,10 @@ jobs:
1212
name: Test deployment
1313
runs-on: ubuntu-latest
1414
steps:
15-
- uses: actions/checkout@v3
16-
- uses: actions/setup-node@v3
15+
- uses: actions/checkout@v4
16+
- uses: actions/setup-node@v4
1717
with:
18-
node-version: 18
18+
node-version: 24
1919
cache: npm
2020

2121
- name: Install dependencies

‎babel.config.js‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎docs/Server-Admin-Onboarding.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -367,7 +367,7 @@ After first login, you can control how additional users are created through Sett
367367
- Verify you're the first user created
368368
- Confirm `SECURITY_ENABLELOGIN=true` is set
369369

370-
:::caution Secure Your Admin Account
370+
:::warning Secure Your Admin Account
371371
- **Change the default password immediately** after first login
372372
- Use a strong password (12+ characters, mixed case, numbers, symbols)
373373
- Consider using SSO (OAuth2/SAML2) to avoid password management entirely
@@ -462,7 +462,7 @@ processExecutor:
462462

463463
Navigate to **Settings → Security**
464464

465-
:::caution Critical for Production
465+
:::warning Critical for Production
466466
These settings directly impact your organization's security. Review carefully!
467467
:::
468468

‎docusaurus.config.js‎

Lines changed: 50 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,25 @@ const config = {
2121
projectName: 'Stirling-PDF', // Usually your repo name.
2222

2323
onBrokenLinks: 'throw',
24-
onBrokenMarkdownLinks: 'warn',
24+
onBrokenAnchors: 'throw',
25+
26+
markdown: {
27+
hooks: {
28+
onBrokenMarkdownLinks: 'warn',
29+
},
30+
},
31+
32+
future: {
33+
v4: {
34+
removeLegacyPostBuildHeadAttribute: true,
35+
},
36+
faster: true,
37+
},
38+
39+
storage: {
40+
type: 'localStorage',
41+
namespace: true,
42+
},
2543

2644
i18n: {
2745
defaultLocale: 'en',
@@ -55,6 +73,28 @@ const config = {
5573
enableInDevelopment: true, // optional
5674
},
5775
],
76+
function scarfTrackingPixelPlugin() {
77+
return {
78+
name: 'scarf-tracking-pixel',
79+
injectHtmlTags() {
80+
return {
81+
postBodyTags: [
82+
{
83+
tagName: 'img',
84+
attributes: {
85+
referrerpolicy: 'no-referrer-when-downgrade',
86+
src: 'https://static.scarf.sh/a.png?x-pxid=5d074971-2ecb-4c54-8397-30c0f91896b3',
87+
height: '1',
88+
width: '1',
89+
style: 'display:none',
90+
alt: 'x',
91+
},
92+
},
93+
],
94+
};
95+
},
96+
};
97+
},
5898
],
5999
clientModules: [
60100
require.resolve('./src/clientModules/anchorScroll.js'),
@@ -84,26 +124,21 @@ const config = {
84124
theme: {
85125
customCss: require.resolve('./src/css/custom.css'),
86126
},
127+
sitemap: {
128+
lastmod: 'date',
129+
priority: null,
130+
changefreq: null,
131+
},
87132
}),
88133
],
89134
],
90-
headTags: [
91-
{
92-
tagName: 'img',
93-
attributes: {
94-
referrerpolicy: 'no-referrer-when-downgrade',
95-
src: 'https://static.scarf.sh/a.png?x-pxid=5d074971-2ecb-4c54-8397-30c0f91896b3',
96-
height: '1',
97-
width: '1',
98-
style: 'display:none',
99-
alt: 'x',
100-
},
101-
},
102-
],
103-
104135
themeConfig:
105136
/** @type {import('@docusaurus/preset-classic').ThemeConfig} */
106137
({
138+
colorMode: {
139+
defaultMode: 'light',
140+
respectPrefersColorScheme: true,
141+
},
107142
// Improve anchor scrolling behavior
108143
scrollToTop: true,
109144
scrollToTopOptions: {

0 commit comments

Comments
 (0)