Bump @docusaurus/plugin-google-gtag from 3.9.2 to 3.10.0#966
Open
dependabot[bot] wants to merge 1 commit intomainfrom
Open
Bump @docusaurus/plugin-google-gtag from 3.9.2 to 3.10.0#966dependabot[bot] wants to merge 1 commit intomainfrom
dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps [@docusaurus/plugin-google-gtag](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag) from 3.9.2 to 3.10.0. - [Release notes](https://github.com/facebook/docusaurus/releases) - [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/docusaurus/commits/v3.10.0/packages/docusaurus-plugin-google-gtag) --- updated-dependencies: - dependency-name: "@docusaurus/plugin-google-gtag" dependency-version: 3.10.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
Changed
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 57866ab. Configure here.
| "@docsearch/react": "^4.6.2", | ||
| "@docusaurus/core": "^3.9.1", | ||
| "@docusaurus/plugin-google-gtag": "^3.9.1", | ||
| "@docusaurus/plugin-google-gtag": "^3.10.0", |
There was a problem hiding this comment.
Docusaurus version skew causes duplicate plugin installations
Medium Severity
Bumping @docusaurus/plugin-google-gtag to ^3.10.0 while @docusaurus/core and @docusaurus/preset-classic remain at ^3.9.1 creates a version skew. The lock file shows the 3.10.0 plugin installs its own nested copies of @docusaurus/core, @docusaurus/babel, @docusaurus/bundler, @docusaurus/types, and other internal packages at 3.10.0. Meanwhile, preset-classic at 3.9.2 creates its own nested copy of plugin-google-gtag at 3.9.2. This results in two versions of the gtag plugin and duplicated Docusaurus internals, which can cause subtle runtime conflicts between mismatched internal APIs. All @docusaurus/* packages need to stay in sync.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 57866ab. Configure here.
🤖 Cursor Dependency AnalysisSupply-Chain Malware ReviewVerifying local dependency manifests for lifecycle scripts and lockfile consistency to support the malware review. Verdict: benign Why this looks safe
Actionable follow-up (optional): Bump the rest of the Docusaurus stack to 3.10.x so you do not run two gtag plugin versions. Compatibility AnalysisTracing how Here’s a concise compatibility and adoption read for this repo. 1) Where it appears
So: the package is only referenced in manifests, not in site configuration. There is no application code in this repo that imports or configures 2) Intersection with 3.10.0 / release notes
Net: Your configured build path does not exercise this plugin, so no meaningful intersection with likely changed gtag APIs for this site as it stands. 3) Risks / unknowns
4) RecommendationMerge-with-caveats
Optional CI check after merge: Malware Scan Summary
Top findings
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps @docusaurus/plugin-google-gtag from 3.9.2 to 3.10.0.
Release notes
Sourced from
@docusaurus/plugin-google-gtag's releases.... (truncated)
Changelog
Sourced from
@docusaurus/plugin-google-gtag's changelog.... (truncated)
Commits
0d98888v3.10.04a0273ffix(create-docusaurus): fix support for TypeScript 6.0 + fix our CI (#11843)1451780chore(ci): fixes for the npm trusted publishing workflow (#11823)5dff744chore(ci): add Trusted Publishing release workflow through dispatch action (#...63ccba8fix(create-docusaurus): update@types/gtag.js to 0.0.20 (#11770)bca9ce7chore: release v3.9.2 (#11491)Maintainer changes
This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for
@docusaurus/plugin-google-gtagsince your current version.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Low risk dependency bump limited to the Docusaurus Google Analytics plugin and its transitive lockfile updates; main risk is unforeseen build/runtime behavior changes from the new plugin version.
Overview
Updates
@docusaurus/plugin-google-gtagfrom3.9.xto3.10.0inpackage.json.Regenerates
package-lock.jsonto pull the new plugin release and updated transitive dependencies (notably@types/gtag.js0.0.12→0.0.20andreact-loadable-ssr-addon-v5-slorber1.0.1→1.0.3), including a nested@docusaurus/*3.10.0subtree under the plugin.Reviewed by Cursor Bugbot for commit 57866ab. Bugbot is set up for automated code reviews on this repo. Configure here.