fix(core): bump detect-port to v2.1, fix pnpm `trustPolicy` downgrade issue by clemens · Pull Request #12012 · facebook/docusaurus

clemens · 2026-05-12T12:38:52Z

Pre-flight checklist

I have read the Contributing Guidelines on pull requests.
If this is a code change: I have written unit tests and/or added dogfooding pages to fully verify the new behavior.
If this is a new API or substantial change: the PR has an accompanying issue (closes #0000) and the maintainers have approved on my working plan.

Motivation

Enabling PNPM's trustPolicy: no-downgrade setting throws warnings about detect-port version 1.6.1 (which Docusaurus uses), because 1.6.0 had provenance whereas 1.6.1 doesn't (which constitutes a downgrade). For 2.1.0, attestations are fine again:

While it would be possible to just whitelist that particular package and version, it seems worth it to me to actually upgrade the dependency:

1.6.1 is more than 2 years old, while 2.1.0 is at least a little younger (1.5 years)
The breaking change in 2.0.0 was the removal of support for Node 16, which shouldn't affect Docusaurus due to its own limitation to Node 24.

Test Plan

Since no code was added/removed, I ran the tests and linters to avoid regressions.

Test links

Deploy preview: https://deploy-preview-12012--docusaurus-2.netlify.app/

Related issues/PRs

socket-security · 2026-05-12T12:40:16Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	detect-port@2.1.0

View full report

socket-security · 2026-05-12T12:40:18Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

netlify · 2026-05-12T12:41:33Z

✅ [V2]

Name	Link
🔨 Latest commit	`2753c37`
🔍 Latest deploy log	https://app.netlify.com/projects/docusaurus-2/deploys/6a340285b9cf1e0008223e79
😎 Deploy Preview	https://deploy-preview-12012--docusaurus-2.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

slorber

Thanks 👍

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@docusaurus/core](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus)) | [`3.10.1` → `3.10.2`](https://renovatebot.com/diffs/npm/@docusaurus%2fcore/3.10.1/3.10.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@docusaurus%2fcore/3.10.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@docusaurus%2fcore/3.10.1/3.10.2?slim=true) | | [@docusaurus/faster](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-faster)) | [`3.10.1` → `3.10.2`](https://renovatebot.com/diffs/npm/@docusaurus%2ffaster/3.10.1/3.10.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@docusaurus%2ffaster/3.10.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@docusaurus%2ffaster/3.10.1/3.10.2?slim=true) | | [@docusaurus/module-type-aliases](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-module-type-aliases)) | [`3.10.1` → `3.10.2`](https://renovatebot.com/diffs/npm/@docusaurus%2fmodule-type-aliases/3.10.1/3.10.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@docusaurus%2fmodule-type-aliases/3.10.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@docusaurus%2fmodule-type-aliases/3.10.1/3.10.2?slim=true) | | [@docusaurus/plugin-content-docs](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-content-docs)) | [`3.10.1` → `3.10.2`](https://renovatebot.com/diffs/npm/@docusaurus%2fplugin-content-docs/3.10.1/3.10.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@docusaurus%2fplugin-content-docs/3.10.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@docusaurus%2fplugin-content-docs/3.10.1/3.10.2?slim=true) | | [@docusaurus/preset-classic](https://github.com/facebook/docusaurus) ([source](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic)) | [`3.10.1` → `3.10.2`](https://renovatebot.com/diffs/npm/@docusaurus%2fpreset-classic/3.10.1/3.10.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@docusaurus%2fpreset-classic/3.10.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@docusaurus%2fpreset-classic/3.10.1/3.10.2?slim=true) | --- ### Release Notes <details> <summary>facebook/docusaurus (@docusaurus/core)</summary> ### [`v3.10.2`](https://github.com/facebook/docusaurus/blob/HEAD/CHANGELOG.md#3102-2026-07-10) [Compare Source](facebook/docusaurus@v3.10.1...v3.10.2) Backport and cherry-pick commits from main for v3.10.2 patch release: - [fix(bundler): do not import `@swc/html`, fix StackBlitz playground #12055](facebook/docusaurus#12055) - [fix(core): use locale url in site config #12054](facebook/docusaurus#12054) - [fix(theme-classic): remove redundant sidebar label titles #11966](facebook/docusaurus#11966) - [fix(mdx-loader): avoid transforming dotted directory links into asset… #11944](facebook/docusaurus#11944) - [fix(dev-server): for HTTPS, support non-RSA TLS certs #12065](facebook/docusaurus#12065) - [fix(utils): fix `extractLeadingEmoji()` edge cases #12100](facebook/docusaurus#12100) - [fix(gtag.js, faster): Fix StackBlitz, vendor `@types/gtag.js`, upgrade `@swc/html` #12080](facebook/docusaurus#12080) - [fix(create-docusaurus): init template README should use npm commands by default #12138](facebook/docusaurus#12138) - [fix(cli): `docusaurus serve` should pass `--host` to `server.listen()` #12127](facebook/docusaurus#12127) - [fix(core): bump detect-port to v2.1, fix pnpm `trustPolicy` downgrade issue #12012](facebook/docusaurus#12012) - [fix(i18n): complete Spanish translations for theme-common and theme-l… #12180](facebook/docusaurus#12180) - [chore(deps): migrate to `@11ty/gray-matter` #12181](facebook/docusaurus#12181) - [fix(core): fix BaseUrlIssueBanner little security issue #12260](facebook/docusaurus#12260) - [fix(core): accept boolean attributes in headTags config validation #12238](facebook/docusaurus#12238) - [fix(sitemap): don't drop lastmod for an epoch (0) timestamp #12212](facebook/docusaurus#12212) - [fix(utils): preserve author names containing commas in git log parsing #12069](facebook/docusaurus#12069) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-on: https://gitea.com/gitea/docs/pulls/466 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Renovate Bot <renovate-bot@gitea.com>

chore(deps): bump detect-port from 1.6.1 to 2.1.0

2c14310

clemens requested review from Josh-Cena and slorber as code owners May 12, 2026 12:38

meta-cla Bot added the CLA Signed Signed Facebook CLA label May 12, 2026

Merge branch 'main' into clemens/main

2753c37

slorber added pr: bug fix This PR fixes a bug in a past release. to backport This PR is planned to be backported to a stable version of Docusaurus labels Jun 18, 2026

slorber changed the title ~~chore(deps): bump detect-port from 1.6.1 to 2.1.0~~ fix(deps): bump detect-port from 1.6.1 to 2.1, fix pnpm trustPolicy downgrade issue Jun 18, 2026

slorber changed the title ~~fix(deps): bump detect-port from 1.6.1 to 2.1, fix pnpm trustPolicy downgrade issue~~ fix(core): bump detect-port to v2.1, fix pnpm trustPolicy downgrade issue Jun 18, 2026

slorber approved these changes Jun 18, 2026

View reviewed changes

slorber merged commit c9e6a30 into facebook:main Jun 18, 2026
38 of 39 checks passed

slorber mentioned this pull request Jul 10, 2026

chore: cherry-pick commits for v3.10.2 patch release #12265

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(core): bump detect-port to v2.1, fix pnpm `trustPolicy` downgrade issue - #12012

fix(core): bump detect-port to v2.1, fix pnpm `trustPolicy` downgrade issue#12012
slorber merged 2 commits into
facebook:mainfrom
clemens:main

clemens commented May 12, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented May 12, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented May 12, 2026 •

edited

Loading

Uh oh!

netlify Bot commented May 12, 2026 •

edited

Loading

Uh oh!

slorber left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

clemens commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pre-flight checklist

Motivation

Test Plan

Test links

Related issues/PRs

Uh oh!

socket-security Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ [V2]

Uh oh!

slorber left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

clemens commented May 12, 2026 •

edited

Loading

socket-security Bot commented May 12, 2026 •

edited

Loading

socket-security Bot commented May 12, 2026 •

edited

Loading

netlify Bot commented May 12, 2026 •

edited

Loading