chore(deps): bump @docusaurus/types from 3.9.2 to 3.10.0 in /docs#338
chore(deps): bump @docusaurus/types from 3.9.2 to 3.10.0 in /docs#338dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps [@docusaurus/types](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-types) from 3.9.2 to 3.10.0. - [Release notes](https://github.com/facebook/docusaurus/releases) - [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/docusaurus/commits/v3.10.0/packages/docusaurus-types) --- updated-dependencies: - dependency-name: "@docusaurus/types" dependency-version: 3.10.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
Greptile SummaryBumps Confidence Score: 5/5Safe to merge — isolated devDependency bump with no runtime impact. Only No files require special attention. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[docs/package.json] -->|devDependency bump| B["@docusaurus/types 3.9.2 → 3.10.0"]
B --> C[docs/pnpm-lock.yaml updated]
C --> D["3.10.0 resolved\n(3.9.2 retained for transitive deps)"]
style B fill:#d4edda,stroke:#28a745
style D fill:#fff3cd,stroke:#856404
Reviews (1): Last reviewed commit: "chore(deps): bump @docusaurus/types from..." | Re-trigger Greptile |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| babel-loader: 9.2.1(@babel/core@7.28.6)(webpack@5.106.1) | ||
| clean-css: 5.3.3 | ||
| copy-webpack-plugin: 11.0.0(webpack@5.104.1) | ||
| css-loader: 6.11.0(webpack@5.104.1) | ||
| css-minimizer-webpack-plugin: 5.0.1(clean-css@5.3.3)(webpack@5.104.1) | ||
| copy-webpack-plugin: 11.0.0(webpack@5.106.1) | ||
| css-loader: 6.11.0(webpack@5.106.1) | ||
| css-minimizer-webpack-plugin: 5.0.1(clean-css@5.3.3)(webpack@5.106.1) | ||
| cssnano: 6.1.2(postcss@8.5.6) | ||
| file-loader: 6.2.0(webpack@5.104.1) | ||
| file-loader: 6.2.0(webpack@5.106.1) | ||
| html-minifier-terser: 7.2.0 | ||
| mini-css-extract-plugin: 2.10.0(webpack@5.104.1) | ||
| null-loader: 4.0.1(webpack@5.104.1) | ||
| mini-css-extract-plugin: 2.10.0(webpack@5.106.1) | ||
| null-loader: 4.0.1(webpack@5.106.1) | ||
| postcss: 8.5.6 | ||
| postcss-loader: 7.3.4(postcss@8.5.6)(typescript@5.9.3)(webpack@5.104.1) | ||
| postcss-loader: 7.3.4(postcss@8.5.6)(typescript@5.9.3)(webpack@5.106.1) | ||
| postcss-preset-env: 10.6.1(postcss@8.5.6) | ||
| terser-webpack-plugin: 5.3.16(webpack@5.104.1) | ||
| terser-webpack-plugin: 5.3.16(webpack@5.106.1) | ||
| tslib: 2.8.1 | ||
| url-loader: 4.1.1(file-loader@6.2.0(webpack@5.104.1))(webpack@5.104.1) | ||
| webpack: 5.104.1 | ||
| webpackbar: 6.0.1(webpack@5.104.1) | ||
| url-loader: 4.1.1(file-loader@6.2.0(webpack@5.106.1))(webpack@5.106.1) | ||
| webpack: 5.106.1 | ||
| webpackbar: 6.0.1(webpack@5.106.1) | ||
| transitivePeerDependencies: | ||
| - '@parcel/css' | ||
| - '@rspack/core' |
There was a problem hiding this comment.
🔴 The pnpm lockfile has a genuine integrity inconsistency introduced by this bump: the url-loader@4.1.1 snapshot key was renamed to url-loader@4.1.1(file-loader@6.2.0(webpack@5.106.1))(webpack@5.106.1) (claiming file-loader resolved against webpack@5.106.1), but the snapshot body's optionalDependencies still references file-loader: 6.2.0(webpack@5.104.1) — the old variant. Additionally, @docusaurus/mdx-loader@3.9.2's direct file-loader dep was not updated to webpack@5.106.1 unlike the sibling bundler and utils snapshots, and @docusaurus/bundler@3.9.2 now resolves webpack@5.106.1 while @docusaurus/core@3.9.2 remains on webpack@5.104.1. To fix the most critical issue, update url-loader's optionalDependencies entry from file-loader: 6.2.0(webpack@5.104.1) to file-loader: 6.2.0(webpack@5.106.1), or run pnpm install again to regenerate a clean lockfile.
Extended reasoning...
Bug 1 (normal severity): url-loader snapshot key/body mismatch
The most concrete issue introduced by this PR is a lockfile integrity inconsistency in the url-loader@4.1.1 snapshot. The snapshot key was updated to url-loader@4.1.1(file-loader@6.2.0(webpack@5.106.1))(webpack@5.106.1), and the webpack dependency inside the snapshot body was correctly set to 5.106.1. However, the optionalDependencies entry was NOT updated and still reads file-loader: 6.2.0(webpack@5.104.1). The snapshot key encodes the peer resolution variant (i.e., which file-loader was resolved) but the actual installed dependency contradicts this — the key claims the webpack@5.106.1 variant of file-loader was used, but the body installs the webpack@5.104.1 variant.
Code path and proof: In docs/pnpm-lock.yaml, the url-loader snapshot key at line ~13553 reads url-loader@4.1.1(file-loader@6.2.0(webpack@5.106.1))(webpack@5.106.1). The dependencies.webpack inside the snapshot was updated to 5.106.1. But optionalDependencies.file-loader at line ~13560 still says 6.2.0(webpack@5.104.1). Both file-loader snapshots coexist: file-loader@6.2.0(webpack@5.104.1) (pre-existing, line ~10318) and the newly added file-loader@6.2.0(webpack@5.106.1) (line ~10324). The url-loader snapshot was only half-updated.
Why existing code doesn't prevent it: This lockfile was generated by Dependabot/pnpm's automatic peer resolution. pnpm partially re-resolved the peer graph when @docusaurus/types was bumped to 3.10.0 (which itself depends on webpack@5.106.1), but the url-loader snapshot's optionalDependencies block was missed in the update.
Impact: Running pnpm install --frozen-lockfile in CI may detect this key/body inconsistency and fail, blocking builds. Even if pnpm silently accepts it, it installs file-loader@6.2.0(webpack@5.104.1) for url-loader while the snapshot key encodes the webpack@5.106.1 variant — a subtle peer dependency mismatch. The practical runtime risk is low since webpack 5.104→5.106 is a minor patch bump with no breaking file-loader API changes.
Bug 2 (nit): @docusaurus/mdx-loader direct file-loader dep not updated
The @docusaurus/mdx-loader@3.9.2 snapshot now has an internal inconsistency: its direct file-loader dependency remains as 6.2.0(webpack@5.104.1) while the same snapshot's url-loader key references 4.1.1(file-loader@6.2.0(webpack@5.106.1))(webpack@5.106.1) and webpack was updated to 5.106.1. The sibling packages @docusaurus/bundler@3.9.2 and @docusaurus/utils@3.9.2 both correctly updated their file-loader deps to 6.2.0(webpack@5.106.1). One refutation notes that since bug 1 means url-loader's optionalDependencies also resolve to webpack@5.104.1 file-loader, all file-loader references in mdx-loader effectively use the same instance — this is correct and reduces the practical impact to cosmetic inconsistency. Severity: nit.
Bug 3 (nit): webpack version split between bundler and core
Before this PR, both @docusaurus/bundler@3.9.2 and @docusaurus/core@3.9.2 resolved to webpack@5.104.1. After this PR, bundler's snapshot was updated to webpack@5.106.1 (all its loaders/plugins updated) while core's snapshot remains on webpack@5.104.1 (html-webpack-plugin, react-loadable-ssr-addon, webpack-dev-server unchanged). One refutation correctly notes this is pnpm's deterministic peer resolution artifact and that webpack plugins use tapable hook APIs (not instanceof checks), making cross-version breakage unlikely at 5.104→5.106. The @docusaurus/types@3.10.0 package was officially released on 2026-04-07 and would have caused widespread failures if this were truly incompatible. Severity: nit.
Fix: The most actionable fix for bug 1 is to manually correct the url-loader snapshot's optionalDependencies entry from file-loader: 6.2.0(webpack@5.104.1) to file-loader: 6.2.0(webpack@5.106.1), or alternatively regenerate the lockfile by running pnpm install from scratch in the docs/ directory.
Bumps @docusaurus/types from 3.9.2 to 3.10.0.
Release notes
Sourced from
@docusaurus/types's releases.... (truncated)
Changelog
Sourced from
@docusaurus/types's changelog.... (truncated)
Commits
0d98888v3.10.04892e7ffeat(core): addfuture.v4.mdx1CompatDisabledByDefaultflag (#11896)1451780chore(ci): fixes for the npm trusted publishing workflow (#11823)5dff744chore(ci): add Trusted Publishing release workflow through dispatch action (#...29c3b5cfeat(core): Docusaurus Faster is stable + v4 future flag turns it on by defau...2a7f8b9feat(core): promotesiteConfig.storageto stable + add `future.v4.siteStora...c6a86fffeat(core): support custom html elements in head tags (#11571)acc66c1feat(core): New siteConfigfuture.experimental_vcsAPI + `future.experimen...bca9ce7chore: release v3.9.2 (#11491)Maintainer changes
This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for
@docusaurus/typessince your current version.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)