Skip to content

chore: merge main into al/docs/content-restructure#2139

Closed
jeffredodd wants to merge 25 commits into
al/docs/content-restructurefrom
jj/merge-main-into-pr-2102
Closed

chore: merge main into al/docs/content-restructure#2139
jeffredodd wants to merge 25 commits into
al/docs/content-restructurefrom
jj/merge-main-into-pr-2102

Conversation

@jeffredodd

Copy link
Copy Markdown
Contributor

Summary

Stacked merge onto Aaron's #2102 — brings main (through cb167c7) onto the branch and reconciles the conflicts and stale references introduced by recent doc work that landed in parallel.

Merge it into Aaron's branch (or have him pull and review), then re-request review on #2102.

What landed since #2102 was opened (and how each was resolved)

Charlie Lai

Marie Chatfield Rivas

  • feat!: remove deprecated namespace exports (Company, Employee, Contractor, GustoApiProvider) #2120 (feat!) removed the deprecated Company / Employee / Contractor namespace exports in favor of journey namespaces. Aaron's PR-introduced surface docs still referenced the removed exports in code samples and prose. Rewrote them across docs/surfaces/**/sub-components.md and docs/build-methods/sub-components.md:
    • Company.*CompanyOnboarding.*
    • Contractor.*ContractorOnboarding.* (onboarding components) or ContractorManagement.* (payment components)
    • Employee.*EmployeeOnboarding.* (build-methods example reused the onboarding Profile)
    • Removed two now-incorrect "Legacy imports via Contractor.* / Employee.* continue to work" callouts.
    • Removed the "(also exported as Employee.FederalTaxes for backwards compatibility)" parenthetical in employee-onboarding/sub-components.md.

Aaron's own conflicts

  • docs-site/sidebars.ts — kept the PR's restructure (Build methods + Surfaces + Customize). Main's docs: remove Hooks experimental label and fix sidebar typo #2130 sidebar fixes were already in Aaron's labels (Hooks, Contractor onboarding).
  • 5 × docs/surfaces/*/sub-components.md — kept the PR's human-readable section headings (e.g. ## Assign a signatory over ### CompanyOnboarding.AssignSignatory).

What didn't change

  • docs/api/ (TypeDoc autogen output) is untouched — confirmed via git diff origin/main -- docs/api/.
  • docs/reference/endpoint-{inventory.json,reference.md} (the OAS-derived autogen) is untouched on the PR side.

Test plan

  • No conflict markers remain (grep -rn '<<<<<<<' docs/ docs-site/ empty)
  • No stale <Company.X> / <Employee.X> / <Contractor.X> JSX in PR-introduced files (grep -nE '<(Company|Employee|Contractor)\.[A-Z]' docs/surfaces/**/sub-components.md docs/build-methods/*.md empty)
  • npm run docs:build succeeds locally (after npm --prefix docs-site run typedoc to generate the gitignored docs/api/)
  • Re-walk the Surfaces sidebar entries to spot-check terminology in the new pages
  • CI docs-build check passes once merged into Aaron's branch

aaronlee777 and others added 25 commits June 12, 2026 20:32
…2114)

fix(docs-site): mobile search modal improvements and dropdown persistence

Center the search modal in the viewport and constrain its height to the
backdrop's flex area so the results region scrolls inside the modal
instead of overflowing the screen on short viewports. Block blur events
from reaching the autocomplete library when the OS window loses focus so
the dropdown stays open and populated when alt-tabbing to another app.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replaces outdated intro copy and broken Drive video links with current
framing. Surfaces all three abstraction levels (workflows, sub-components,
hooks) in the intro and benefit bullets, and adds a minimal Quick example
code snippet as an immediate on-ramp for new visitors.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds an ADR capturing the five Phase 1a infrastructure decisions —
repo strategy, deployment target, domain, publishing trigger, search —
that have already been made implicitly via merged code. Closes out
the Phase 1a deliverable in SDK-758.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Removes outdated "early phase of development" framing and rewrites the
page to lead with a clear recommendation (use the SDK if you're on React)
rather than a hedged comparison. Adds hooks as an explicit consideration,
merges the pre-built UI and headless hooks bullets, tightens the
"consider a different approach" section to two clear scenarios, and
replaces the "talk to a Solutions Architect" CTA with direct Next steps
links.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
…2117)

feat(Employee): surface PayrollOption + termination props on EmployeeManagement

Adds PayrollOption and the TerminateEmployee/TerminationSummary/TerminationFlow
props types to the EmployeeManagement barrel so partners using the block
components directly can type the payrollOption value without redefining the
union locally. Matches the component+props export pattern used by every other
entry in the barrel and the existing PayrollOption export on the Employee barrel.

Co-authored-by: Cursor <cursoragent@cursor.com>
…yDetail blocks (#2119)

The TimeOff namespace only exported the presentational variants of these two
steps, forcing integrators to fall back to the all-in-one TimeOffFlow to
compose the sick/vacation path behind their own router. The data-connected
components already existed and were used internally by TimeOffFlow; they were
simply not part of the public surface.

This wires them into the public barrel so they are importable as
TimeOff.PolicySettings / TimeOff.TimeOffPolicyDetail, each rendering and
fetching from just policyId + onEvent, consistent with every other TimeOff
block (PolicyList, PolicyConfigurationForm, etc.). The presentational variants
remain available under their *Presentation names.

BREAKING CHANGE: TimeOff.PolicySettings now refers to the data-connected
component, whose props are { policyId, mode?, onEvent } (PolicySettingsProps),
not the presentational props. The presentational component is now exported as
TimeOff.PolicySettingsPresentation with PolicySettingsPresentationProps. Update
imports of the presentational component and its props accordingly.

Co-authored-by: Cursor <cursoragent@cursor.com>
DismissalPayPeriodSelection is a standalone block component consistent
with other SDK components but was not exported from the Payroll
namespace, so it could not be used independently. Surface it (and its
props) through the Dismissal and Payroll namespace indexes, and
regenerate the API report and endpoint inventory.

Co-authored-by: Cursor <cursoragent@cursor.com>
…2126)

Bumps [@microsoft/api-extractor](https://github.com/microsoft/rushstack/tree/HEAD/apps/api-extractor) from 7.58.8 to 7.58.9.
- [Changelog](https://github.com/microsoft/rushstack/blob/main/apps/api-extractor/CHANGELOG.md)
- [Commits](https://github.com/microsoft/rushstack/commits/@microsoft/api-extractor_v7.58.9/apps/api-extractor)

---
updated-dependencies:
- dependency-name: "@microsoft/api-extractor"
  dependency-version: 7.58.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [react-hook-form](https://github.com/react-hook-form/react-hook-form) from 7.78.0 to 7.79.0.
- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)
- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)
- [Commits](react-hook-form/react-hook-form@v7.78.0...v7.79.0)

---
updated-dependencies:
- dependency-name: react-hook-form
  dependency-version: 7.79.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.9 to 3.4.10.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.9...3.4.10)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
)

Bumps [@storybook/react-vite](https://github.com/storybookjs/storybook/tree/HEAD/code/frameworks/react-vite) from 10.4.3 to 10.4.4.
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.4.4/code/frameworks/react-vite)

---
updated-dependencies:
- dependency-name: "@storybook/react-vite"
  dependency-version: 10.4.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#2127)

Adds hooks as a first-class component type, reorders from most to least
customizable (hooks → sub-components → workflows), and introduces a
comparison table for quick scanning. Renames "Building Block" to
"sub-component" for consistency with public-facing terminology. Removes
the outdated "talk to a specialist" closing and replaces it with a
practical pattern note.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
…ctor, GustoApiProvider) (#2120)

* feat!: remove deprecated GustoApiProvider export

GustoApiProvider was deprecated since 0.8.0 as an alias for GustoProvider.
Removes the export, its re-export shim directory, and updates the one
internal test and two internal comments that still referenced it.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat!: remove deprecated Employee namespace export

Employee.* was deprecated in 0.40.0 in favour of the journey-based
EmployeeOnboarding and EmployeeManagement namespaces. Regenerates the
endpoint inventory and reference docs to drop the old entries.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat!: remove deprecated Company namespace export

Company.* was deprecated in 0.40.0 in favour of CompanyOnboarding
(and a future CompanyManagement). Regenerates endpoint inventory and
reference docs to drop the old entries.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat!: remove deprecated Contractor namespace export

Contractor.* was deprecated in favour of ContractorOnboarding (and a
future ContractorManagement for the payment components). Regenerates
endpoint inventory and reference docs to drop the old entries.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat!: add ContractorManagement namespace and recover missing prop types

- Add ContractorManagement namespace with the 6 payment components that
  had no journey-based home after Contractor.* was removed
- Export termination prop types (TerminateEmployeeProps, TerminationFlowProps,
  TerminationSummaryProps, PayrollOption) from EmployeeManagement, where they
  were only accessible via the removed Employee.* namespace
- Export EmploymentEligibilityProps from EmployeeOnboarding (user-staged)
- Regenerate endpoint inventory, endpoint reference, and api report

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: update workflow docs to use journey-based namespaces

Remove "Legacy imports continue to work" notes (now false) and update
all code examples and section headings from the removed umbrella
namespaces (Employee.*, Company.*, Contractor.*) to their journey
equivalents (EmployeeOnboarding.*, EmployeeManagement.*,
CompanyOnboarding.*, ContractorOnboarding.*, ContractorManagement.*).

Also exports EmployeeManagement.Dashboard and DashboardProps, which
were reachable via Employee.Dashboard but missing from the journey
namespace export.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: fix broken anchor links after namespace rename in workflow docs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
…e npm_and_yarn across dirs (#2122)

build(deps): bump esbuild

Bumps the npm_and_yarn group with 1 update in the /docs-site directory: [esbuild](https://github.com/evanw/esbuild).


Removes `esbuild`

---
updated-dependencies:
- dependency-name: esbuild
  dependency-version:
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore: run knip on src/components/Employee

* chore: export employee hook form fields

* docs: add TSDoc to Employee flow components and onboarding compensation

Documents OnboardingFlow, OnboardingExecutionFlow, SelfOnboardingFlow,
EmployeeListFlow, TerminationFlow, TerminateEmployee, TerminationSummary,
and the onboarding Compensation component with full @public TSDoc sourced
from docs/workflows-overview. Marks companion internals (@internal).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: mark Employee internals @internal, add @public to schema types

Tags state machines, contextual wrappers, view/presentation components,
dictionary hooks, and schema factory functions as @internal across
src/components/Employee. Promotes partner-facing schema exports
(FormData, FormField, ErrorCodes, enum constants, OptionalFieldsToRequire)
to @public with TSDoc. Fixes SplitPaymentsFormData type alias (reverted
from interface to preserve Record assignability).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: add TSDoc to remaining Employee domain components

Covers Compensation (edit forms), Deductions, Documents, EmployeeList,
FederalTaxes, HomeAddress, PaymentMethod, Paystubs, Profile, StateTaxes,
and WorkAddress — both management and onboarding surfaces plus all shared
hooks, field components, and form hooks.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: add TSDoc to useHomeAddressForm and useWorkAddressForm

Fixes remaining tsdoc-coverage errors: props interfaces, fields
interfaces, ready types, hook functions, and convenience type aliases for
both home-address and work-address form hooks.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: export props types alongside Employee component exports

Each component in employeeOnboarding.ts and employeeManagement.ts now
re-exports its props type. Three props interfaces that were internal are
made exported: EmployeeListProps (onboarding), EmployeeDocumentsProps,
and ManagementEmployeeListProps.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: add TSDoc to EditCompensation, ManagementEmployeeList, useEmployeeDetailsForm, and PAY_PERIODS

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: expand domain hub pages to list components and hooks

Replace the flat namespaces table and bare hooks link with per-namespace
sections that enumerate Flow Components and Block Components (each with a
linked entry and summary), and a Hooks table that lists every hook with
its description linking directly to its anchor on the hooks page.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: format fix

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs: add versioned documentation support (SDK-766)

Configure Docusaurus versioning so partners on older SDK versions can
view docs matching their installed version. Cut the first snapshot for
the current released minor (0.47).

- Snapshots are keyed by minor (0.47, 0.48, ...). Patch releases
  overwrite the existing minor's snapshot content in place via a small
  scripts/docs-snapshot.mjs orchestrator; new minors go through the
  standard `docusaurus docs:version` flow.
- Direct cp on the patch path (instead of delete + re-add via
  `docusaurus docs:version`) is required because `lastVersion: 'X.Y'`
  in docusaurus.config.ts is validated against versions.json at config
  load time — removing the version to re-add it leaves the config
  transiently invalid.
- `lastVersion: '0.47'` points unprefixed `/docs/...` at the latest
  released snapshot; live in-development content lives at `/docs/next/`.
- Navbar gains a `docsVersionDropdown` between Docs and GitHub.
- Release skill (.claude/commands/release.md) gains a snapshot step that
  amends onto the chore: release commit. Cadence and gotchas documented
  in CONTRIBUTING.md.

Trade-off noted in CONTRIBUTING.md: patch releases refresh snapshot
markdown but not the snapshot's sidebar JSON. Patches that restructure
the sidebar must hand-edit the versioned sidebars file alongside
sidebars.ts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs: address Cursor-bot review on PR #2076

- Replace unsafe `as string[]` cast on versions.json parse with an
  `isStringArray` type guard that throws on shape mismatch. No new
  dependency added; the file we read is one we own at build time.
- Add a good/bad code example beneath the "Markdown links" section in
  CONTRIBUTING.md so the relative-link rule is concrete.

Branch is also rebased onto current main, which clears the unrelated
package.json / lock downgrade noise the bot flagged (the bot's review
was cross-posted from a different PR; the dep changes only appeared
because the branch was behind main).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* style: apply prettier formatting

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…n the npm_and_yarn group across 1 directory (#2132)

build(deps): bump launch-editor

Bumps the npm_and_yarn group with 1 update in the /docs-site directory: [launch-editor](https://github.com/vitejs/launch-editor).


Updates `launch-editor` from 2.13.2 to 2.14.1
- [Commits](vitejs/launch-editor@v2.13.2...v2.14.1)

---
updated-dependencies:
- dependency-name: launch-editor
  dependency-version: 2.14.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…rn group across 1 directory (#2131)

build(deps-dev): bump form-data

Bumps the npm_and_yarn group with 1 update in the / directory: [form-data](https://github.com/form-data/form-data).


Updates `form-data` from 4.0.5 to 4.0.6
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.5...v4.0.6)

---
updated-dependencies:
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
After a successful npm publish, launch a Cursor cloud agent against
Gusto/embedded-react-sdk-demo-app that runs the demo repo's
update-embedded-react-sdk skill end to end (upgrade to the published
version and open a PR). Placed after the publish step so it only fires
on a real publish; reads CURSOR_API_KEY from repo secrets.

Co-authored-by: Cursor <cursoragent@cursor.com>
The comparison table on this page contained outdated copy ("Workflows are
limited but planned on our developer roadmap") and was redundant with the
reframed Deciding to Build and Component Types pages. Removes the file and
its sidebar entry.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs: remove Hooks experimental label and fix sidebar typo

Drops the "(Experimental)" qualifier from the Hooks sidebar label — hooks
are a permanent and expanding part of the SDK portfolio. Also removes the
redundant experimental callout from hooks.md, and fixes a typo in the
Contractors sidebar entry ("Conractor" → "Contractor").

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: update sidebar labels for hooks and contractor onboarding

Removes "(Experimental)" from the Hooks sidebar label and fixes a typo
("Conractor" → "Contractor") in the Contractors workflow entry.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
chore(sdk-app): include unprocessed payrolls in entity catalog with status badge

The settings panel's payroll picker was hitting `/v1/companies/:id/payrolls`
with no params, which defaults to processed-only on the past 6 months.
Pass `processing_statuses=processed,unprocessed` and a 6mo-past →
3mo-future date window so upcoming unprocessed payrolls are pickable, and
tag each option with a Processed/Unprocessed badge so the state is clear at
a glance.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* docs: hide Next from version dropdown and remove version banner

Two visual cleanups to the published docs site:

- Drop the in-development `current` version entirely via
  `includeCurrentVersion: false`. Removes the "Next (unreleased)"
  entry from the navbar dropdown and the `/docs/next/` route.
- Suppress the per-page version banner ("This is documentation for…")
  on every released version by mapping each entry in versions.json to
  `{ banner: 'none' }`. The selected version is already obvious from
  the navbar dropdown.

Both behaviors only activate downstream where `versions.json` is
present — the in-repo single-version site is unchanged.

Verified by staging a local `versions.json: ["0.47"]` + snapshot,
running `npm run build`, and confirming the built HTML contains
only `0.47` in the navbar, no `/docs/next/` directory, and no
version-banner markup.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs: also disable the per-page Version badge

Adds `badge: false` alongside `banner: 'none'` on each versioned
entry. Removes the "Version: 0.47" pill that Docusaurus' default
DocVersionBadge renders above each page title — selected version
is already visible in the navbar dropdown.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
#2135)

Replaces the loose row layout in PayrollEditEmployeePresentation with a
DataView (Description / Amount / Type columns) for itemized reimbursements.
When the list is empty, the DataView renders an EmptyData state with an
inline secondary "Add one-time reimbursement" button (PlusCircleIcon), and
the outside Add button is hidden. The outside button is also hidden while
the inline draft form is open on an empty list. Off-cycle payroll's single
Reimbursement input is unchanged.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Reconciles the doc restructure with recent main work:
- Charlie #2118/#2127/#2128: deciding-to-build content (delete accepted; new structure under docs/build-methods/ subsumes the topic)
- Charlie #2130: removed Hooks "(Experimental)" sidebar label and the experimental callout in docs/hooks/hooks.md and docs/build-methods/hooks.md
- Marie #2120 (feat!): renamed namespaces in code samples under docs/surfaces/* and docs/build-methods/sub-components.md — Company.* → CompanyOnboarding.*, Contractor.* → ContractorOnboarding.* or ContractorManagement.* (payments), Employee.* → EmployeeOnboarding.*; dropped now-stale "Legacy imports continue to work" callouts and the "(also exported as Employee.FederalTaxes for backwards compatibility)" parenthetical

Conflict resolution notes:
- docs-site/sidebars.ts: kept PR-side restructure (Build methods + Surfaces + Customize)
- 5 surfaces sub-components.md files: kept PR-side human-readable section headings
@jeffredodd jeffredodd requested a review from a team as a code owner June 15, 2026 21:16
@jeffredodd jeffredodd marked this pull request as draft June 15, 2026 21:18
@socket-security

Copy link
Copy Markdown

Caution

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. For more information please check in at #security-help. For License Policy Violations please also tag @Aoife in #security-help.

Action Severity Alert  (click "▶" to expand/collapse)
Block High
License policy violation: npm lightningcss-android-arm64 under MPL-2.0

Location: Package overview

From: docs-site/package-lock.jsonnpm/vite@8.0.16npm/lightningcss-android-arm64@1.32.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-android-arm64@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
License policy violation: npm lightningcss-darwin-arm64 under MPL-2.0

Location: Package overview

From: docs-site/package-lock.jsonnpm/vite@8.0.16npm/lightningcss-darwin-arm64@1.32.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-darwin-arm64@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
License policy violation: npm lightningcss-darwin-x64 under MPL-2.0

Location: Package overview

From: docs-site/package-lock.jsonnpm/vite@8.0.16npm/lightningcss-darwin-x64@1.32.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-darwin-x64@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
License policy violation: npm lightningcss-freebsd-x64 under MPL-2.0

Location: Package overview

From: docs-site/package-lock.jsonnpm/vite@8.0.16npm/lightningcss-freebsd-x64@1.32.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-freebsd-x64@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
License policy violation: npm lightningcss-linux-arm-gnueabihf under MPL-2.0

Location: Package overview

From: docs-site/package-lock.jsonnpm/vite@8.0.16npm/lightningcss-linux-arm-gnueabihf@1.32.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-linux-arm-gnueabihf@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
License policy violation: npm lightningcss-linux-arm64-gnu under MPL-2.0

Location: Package overview

From: docs-site/package-lock.jsonnpm/vite@8.0.16npm/lightningcss-linux-arm64-gnu@1.32.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-linux-arm64-gnu@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
License policy violation: npm lightningcss-linux-arm64-musl under MPL-2.0

Location: Package overview

From: docs-site/package-lock.jsonnpm/vite@8.0.16npm/lightningcss-linux-arm64-musl@1.32.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-linux-arm64-musl@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
License policy violation: npm lightningcss-linux-x64-gnu under MPL-2.0

Location: Package overview

From: docs-site/package-lock.jsonnpm/vite@8.0.16npm/lightningcss-linux-x64-gnu@1.32.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-linux-x64-gnu@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
License policy violation: npm lightningcss-linux-x64-musl under MPL-2.0

Location: Package overview

From: docs-site/package-lock.jsonnpm/vite@8.0.16npm/lightningcss-linux-x64-musl@1.32.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-linux-x64-musl@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
License policy violation: npm lightningcss-win32-arm64-msvc under MPL-2.0

Location: Package overview

From: docs-site/package-lock.jsonnpm/vite@8.0.16npm/lightningcss-win32-arm64-msvc@1.32.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-win32-arm64-msvc@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
License policy violation: npm lightningcss-win32-x64-msvc under MPL-2.0

Location: Package overview

From: docs-site/package-lock.jsonnpm/vite@8.0.16npm/lightningcss-win32-x64-msvc@1.32.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-win32-x64-msvc@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
License policy violation: npm lightningcss under MPL-2.0

Location: Package overview

From: docs-site/package-lock.jsonnpm/vite@8.0.16npm/lightningcss@1.32.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: docs-site/package-lock.jsonnpm/@easyops-cn/docusaurus-search-local@0.55.1npm/@emnapi/runtime@1.11.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@jeffredodd jeffredodd closed this Jun 15, 2026
@jeffredodd jeffredodd deleted the jj/merge-main-into-pr-2102 branch June 15, 2026 21:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants