Nextra V1.1 - security warning caused by "The got package before 11.8.5 and 12.1.0" - how to fix?

[mi-hol]

Many thanks for the great tool Nextra!

When I enabled "security" in my repo I got the following alert:

Got allows a redirect to a UNIX socket

Dependabot cannot update got to a non-vulnerable version
The latest possible version that can be installed is 8.3.2 because of the following conflicting dependency:

nextra@1.1.0 requires got@^8.3.1 via a transitive dependency on download@8.0.0
The earliest fixed version is 11.8.5.

As V2 is still in beta I wonder if a fix for V1.1 is possible and could be made available?

[mi-hol]

@shuding a comment would be greatly appreciated

[shuding]

Apologies as I don't currently have bandwidth, maybe next week I can take a deeper look. However I guess that vulnerability in got won't affect your application because 1.1 shouldn't rely on got directly.

[mi-hol]

@shuding unfortunately even a security issue of a transitive dependency is a blocker for moving a finished solution from development to production. All users of released version Nextra 1.1 are affected!
"nextra@1.1.0 requires got@^8.3.1 via a transitive dependency on download@8.0.0"
Simply upgrading components wont work due to incompatible changes :(
I lack the understanding to create a fix unfortunately, but would be happy to contribute by testing a fixed version.

[mi-hol]

Great to see version 2 released, unfortunately the docs don't mention "how to upgrade from version 1.1"
Could these instruction be added please?

[dimaMachina]

there will be no updates for Nextra 1, use Nextra 3

[mi-hol]

@dimaMachina thank you so much for answering.

I tried to migrate to Nextra 3.0.15 but get the error below that I fail to understand "how to fix".

Searching around in Nextra doc I missed to find a topic related to "upgrade to V3" only as a coincidence I stumbled over the V3 blog post https://the-guild.dev/blog/nextra-3
May I suggest to move the section related to upgrade to the documentation site as a new topic ?

Maybe you'd have a hint "how to fix" below error easily ?
Or
Is a better approach to recreate the whole project with V3?

the related changes are in this branch

Update (after some change to migrate code):

pnpm build

> nextra-docs-template@0.0.1 build C:\Users\mholzer\Documents\git\boc-kb-v2
> next build

  ▲ Next.js 14.2.13

 ✓ Linting and checking validity of types
   Creating an optimized production build ...
Failed to compile.

./pages/_meta.js
TypeError [ERR_PACKAGE_IMPORT_NOT_DEFINED]: Package import specifier "#minpath" is not defined imported from C:\Users\mholzer\Documents\git\boc-kb-v2\node_modules\.pnpm\nextra@3.0.15_@types+react@18.3.11_acorn@8.13.0_next@14.2.13_react-dom@18.3.1_react@18.3.1__r_qgry66gck4h276osaylx6wtrfe\node_modules\nextra\node_modules\.pnpm\vfile@6.0.3\node_modules\vfile\lib\index.js
    at importNotDefined (node:internal/modules/esm/resolve:283:10)
    at packageImportsResolve (node:internal/modules/esm/resolve:733:9)
    at moduleResolve (node:internal/modules/esm/resolve:898:16)
    at defaultResolve (node:internal/modules/esm/resolve:1038:11)
    at ModuleLoader.defaultResolve (node:internal/modules/esm/loader:557:12)
    at ModuleLoader.resolve (node:internal/modules/esm/loader:525:25)
    at ModuleLoader.getModuleJob (node:internal/modules/esm/loader:246:38)
    at ModuleJob._link (node:internal/modules/esm/module_job:126:49)

Import trace for requested module:
./pages/_meta.js

./pages/03_Maintenance/_meta.js
TypeError [ERR_PACKAGE_IMPORT_NOT_DEFINED]: Package import specifier "#minpath" is not defined imported from C:\Users\mholzer\Documents\git\boc-kb-v2\node_modules\.pnpm\nextra@3.0.15_@types+react@18.3.11_acorn@8.13.0_next@14.2.13_react-dom@18.3.1_react@18.3.1__r_qgry66gck4h276osaylx6wtrfe\node_modules\nextra\node_modules\.pnpm\vfile@6.0.3\node_modules\vfile\lib\index.js

[mi-hol]

new discussion started focusing on migration on V1.1 to V3