Skip to content

chore(plugin-sitemap): Update sitemap package 📝#11854

Draft
sanjaiyan-dev wants to merge 1 commit intofacebook:mainfrom
sanjaiyan-dev:sanjaiyan-package-update
Draft

chore(plugin-sitemap): Update sitemap package 📝#11854
sanjaiyan-dev wants to merge 1 commit intofacebook:mainfrom
sanjaiyan-dev:sanjaiyan-package-update

Conversation

@sanjaiyan-dev
Copy link
Copy Markdown
Contributor

I've put together a small PR to update the sitemap dependency from ^7.1.1 to ^9.0.1. I noticed the older version is missing some recent security patches, so I'm hoping this update is helpful!

Key improvements in this bump:

  • Security Patches: Resolves vulnerabilities including XML injection, memory DoS, and arbitrary file writes (v8.0.1 & v9.0.1).
  • Node.js Fixes: Resolves a circular dependency issue that breaks Node 20.6+ (v7.1.2).

⚠️ Important Note:
Version 9.0.0 drops support for Node.js < 20 (it requires >=20.19.5).

Extremely sorry if I made any mistakes :)

Pre-flight checklist

  • I have read the Contributing Guidelines on pull requests.
  • If this is a code change: I have written unit tests and/or added dogfooding pages to fully verify the new behavior.
  • If this is a new API or substantial change: the PR has an accompanying issue (closes #0000) and the maintainers have approved on my working plan.

@meta-cla meta-cla bot added the CLA Signed Signed Facebook CLA label Mar 28, 2026
@netlify
Copy link
Copy Markdown

netlify bot commented Mar 28, 2026

[V2]

Built without sensitive environment variables

Name Link
🔨 Latest commit 793d6db
🔍 Latest deploy log https://app.netlify.com/projects/docusaurus-2/deploys/69c803f4963a4b000876ae1d
😎 Deploy Preview https://deploy-preview-11854--docusaurus-2.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@sanjaiyan-dev sanjaiyan-dev changed the title chore(plugin-sitemap): Update sitemap package chore(plugin-sitemap): Update sitemap package 📝 Mar 28, 2026
@slorber slorber marked this pull request as draft March 30, 2026 07:39
@slorber
Copy link
Copy Markdown
Collaborator

slorber commented Mar 30, 2026

It's not possible yet to upgrade to v9 since it has breaking changes for Docusaurus v3 users (requiring a nodejs version newer than 20.0 that we currently support): https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0

However I think it's possible to upgrade to v8

I doubt any of the security issue fixed in the lib really affect anyone, so it's not a priority to do this upgrade. We'll do this for Docusaurus v4.

@slorber slorber added this to the 4.0 milestone Mar 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed Signed Facebook CLA

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants