Migration Website to Docusaurus 2 Alpha about fbt

[yangshun]

Btw @sshhdaniella is saying that he will be helping to do the migration. On our end we just need to review.

[yangshun]

Option 2. @sshhdaniella will do the migration, we (Docusaurus side + FBT) will review together

[yangshun]

Hey @jrwats, for those Docusaurus 1 security vulnerabilities, I've fixed them upstream and upgrading your Docusaurus version would get rid of them. You could do that first in the meanwhile.

[yangshun]

Ref: facebook/docusaurus#1834

[jrwats]

Embeddable interactive React components within markdown via MDX

Yes! I've been wanting to add our demo app to the docs! https://i.giphy.com/3o6ZteX8cqJRH4TwQ0.gif

cc @w1106c @kayhadrin

[jrwats]

Sorry are we

1. Supposed to do this migration and have you/Daniella review, or
2. is @sshhdaniella doing this migration with your review?

Either way it'll be nice to have embedded React

[jrwats]

Awesome

[jrwats]

@sshhdaniella, what does your timeline look like for this? I ask because we have 2 vulnerabilities from the packages remarkable <= 1.7.1 and underscore.string < 3.3.5 that are only brought in due to Docusaurus v1.

[jrwats]

It looks like docusaurus v1.14.0 still depends on [email protected].

Does this actually fix the security vulnerability? The issue I have says there's "No fix version known"

Package name: remarkable
Affected versions: <= 1.7.1
Fixed in version: (No fix version known)
CVE: CVE-2019-12043
Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-12043

[jrwats]

@yangshun remarkable 1.7.4 is still bringing in underscore.string too

[yangshun]

@sshhdaniella I'm freeing up this issue for others to take up since we have not gotten a response from you. Let us know if you're still interested.

[yangshun]

@jrwats apologies for the mistake, it's weird that only fbt is seeing the vulnerability. I'll try to get someone to migrate fbt or even do it myself so that the vulnerability goes away.

For the most part, most security vulnerabilities are low-signal and since docusaurus produces statically generated sites, the severity is smaller.

[endiliey]

try running yarn upgrade to recreate lockfile. also make sure to update to latest version of docusaurus

[dtaylorbrown]

@yangshun Hi, apologies for the delay. I've recently gotten married and have since been away and taken some time off. Yes, please feel free to re-assign, I most likely won't get the time in the coming weeks to work on this.