Migration Website to Docusaurus 2 Alpha

[dtaylorbrown]

Hi there! The Docusaurus team is currently developing Docusaurus 2 and are almost done with an MVP that doesn't include translations and versioning features, which means there's feature parity with your website's current usage of Docusaurus.

Docusaurus 2 brings about many improvements:

• Client-side rendering with prerendering (site renders without JavaScript!)
• More flexible appearance - Customizable layouts, CSS modules, etc
• Embeddable interactive React components within markdown via MDX

I will be your POC in helping you throughout the migration process. Let me know what you think!

cc @yangshun @endiliey

[yangshun]

Ref: facebook/docusaurus#1834

[jrwats]

Embeddable interactive React components within markdown via MDX

Yes! I've been wanting to add our demo app to the docs! https://i.giphy.com/3o6ZteX8cqJRH4TwQ0.gif

cc @w1106c @kayhadrin

[yangshun]

Btw @sshhdaniella is saying that he will be helping to do the migration. On our end we just need to review.

[jrwats]

Sorry are we

1. Supposed to do this migration and have you/Daniella review, or
2. is @sshhdaniella doing this migration with your review?

Either way it'll be nice to have embedded React

[yangshun]

Option 2. @sshhdaniella will do the migration, we (Docusaurus side + FBT) will review together

[jrwats]

Awesome

[jrwats]

@sshhdaniella, what does your timeline look like for this? I ask because we have 2 vulnerabilities from the packages remarkable <= 1.7.1 and underscore.string < 3.3.5 that are only brought in due to Docusaurus v1.

[yangshun]

Hey @jrwats, for those Docusaurus 1 security vulnerabilities, I've fixed them upstream and upgrading your Docusaurus version would get rid of them. You could do that first in the meanwhile.

[jrwats]

It looks like docusaurus v1.14.0 still depends on [email protected].

Does this actually fix the security vulnerability? The issue I have says there's "No fix version known"

Package name: remarkable
Affected versions: <= 1.7.1
Fixed in version: (No fix version known)
CVE: CVE-2019-12043
Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-12043

[jrwats]

@yangshun remarkable 1.7.4 is still bringing in underscore.string too

[yangshun]

@sshhdaniella I'm freeing up this issue for others to take up since we have not gotten a response from you. Let us know if you're still interested.

[yangshun]

@jrwats apologies for the mistake, it's weird that only fbt is seeing the vulnerability. I'll try to get someone to migrate fbt or even do it myself so that the vulnerability goes away.

For the most part, most security vulnerabilities are low-signal and since docusaurus produces statically generated sites, the severity is smaller.

[endiliey]

try running yarn upgrade to recreate lockfile. also make sure to update to latest version of docusaurus

[dtaylorbrown]

@yangshun Hi, apologies for the delay. I've recently gotten married and have since been away and taken some time off. Yes, please feel free to re-assign, I most likely won't get the time in the coming weeks to work on this.