chore(deps): bump docusaurus-plugin-llms from 0.2.2 to 0.5.1

[dependabot]

Bumps docusaurus-plugin-llms from 0.2.2 to 0.5.1.

Release notes

Sourced from docusaurus-plugin-llms's releases.

v0.5.1 — path & route resolution fixes

Bug-fix release for individual .md generation — path and route resolution.

Fixed

• Numeric frontmatter slug/id/title — unquoted YAML numbers (e.g. slug: 2025) are now coerced to strings, matching how Docusaurus routes them, so the .md is written at the correct route instead of a fallback filename. (#58)
• baseUrl applied twice on disk — with a non-root baseUrl, files were nested one level too deep and their links 404'd; the baseUrl segment is now stripped before deriving the physical path. (#59)
• Compound numeric prefixes — ordering prefixes are parsed like Docusaurus's DefaultNumberPrefixParser (e.g. 03--1.6.X → 1.6.X), and version/date-like names such as 7.0-foo are preserved. (#59)
• Explicit slug/id precedence — an authoritative frontmatter slug/id (including slug: "/") is consulted before the filename-tail heuristic, so a root page no longer loses its route to a coincidental match. (#59)

Thanks to @​AlexAdiaconitei (#59) and @​ratansen (#58).

v0.5.0 — multi-version llms.txt + @​site partials

Added

• Multi-version output via a new versions option. Generate a separate set of LLM files per documentation version, each written under its own subdirectory with links scoped to that version's routes. Accepts an explicit array of versions ({ name, label, docsDir, path, customLLMFiles, includeOrder }) or 'auto' to detect them from Docusaurus docs versioning (versions.json + versioned_docs/). Omitting versions preserves the existing single-root behavior. (#56)

Fixed

• @site alias partials are now resolved and inlined (previously the import was stripped but the JSX tag survived, dropping the partial's content). Partials in a /partials/ directory are recognized alongside the _partial convention, and a partial's own import lines are stripped before inlining so they don't leak into lists. (#55, closes #54)
• @site imports resolve against the site directory (threaded siteDir) rather than process.cwd(). (#57)

v0.4.0

What's New

• Append .md to llms.txt link URLs — Per the llmstxt.org spec, links in llms.txt now point to markdown versions of pages (e.g. /docs/intro.md instead of /docs/intro/). (#38)
• Fix import/export in descriptions — .mdx files starting with import or export statements no longer use those lines as page descriptions. (#39)
• Added test coverage for import/export description extraction fix. (#40)

Breaking Change

addMdExtension defaults to true. All link URLs in generated llms.txt files will now have .md appended. To preserve the previous behavior, set addMdExtension: false in your plugin config.

Full Changelog: rachfop/docusaurus-plugin-llms@v0.3.1...v0.4.0

v0.3.1

Bug Fixes

• #31 — Doubled docs/docs/ paths when routeBasePath: '/' and docs live in a nested docs/ subdirectory
• #30 — trailingSlash: true not reflected in generated URLs

What Changed

Replaced the routeMap construction approach with suffix-based matching against Docusaurus's own routesPaths. This removes ~150 lines of production code (five edge-case helper functions) and makes URL resolution simpler and more correct across all common Docusaurus configurations.

Note: pathTransformation is now only applied as a fallback when a file cannot be matched to a known Docusaurus route. In most configurations, you no longer need it.

Thanks to @​scottamain for the fix!

v0.3.0 - Stability and Robustness Release

Highlights

... (truncated)

Changelog

Sourced from docusaurus-plugin-llms's changelog.

[0.5.1] - 2026-07-22

Fixed

• Numeric frontmatter slug/id ignored — an unquoted numeric slug/id (YAML parses slug: 2025 as a number) is now coerced to a string, matching how Docusaurus routes it, so the .md is written at the correct route instead of a fallback filename. (#58)
• baseUrl applied twice on disk — with a non-root baseUrl, individual .md files were written nested under the baseUrl segment, so their links 404'd. The baseUrl path is now stripped before deriving the physical file location. (#59)
• Compound numeric prefixes — ordering prefixes are now parsed like Docusaurus's DefaultNumberPrefixParser (e.g. 03--1.6.X → 1.6.X), and version-like names such as 7.0-foo are preserved. (#59)
• Explicit frontmatter slug/id overridden by a coincidental route — an authoritative slug/id (including slug: "/") is now consulted before the filename-tail heuristic, so a root page no longer loses its route to an unrelated file. (#59)

[0.5.0] - 2026-07-17

Added

• Multi-version output via a new versions option. Generate a separate set of LLM files per documentation version, each written under its own subdirectory with links scoped to that version's routes. Accepts an explicit array of versions ({ name, label, docsDir, path, customLLMFiles, includeOrder }) or 'auto' to detect them from Docusaurus docs versioning (versions.json + versioned_docs/). Omitting versions preserves the existing single-root behavior. Unset per-version fields fall back to the top-level options.

[0.4.5] - 2026-07-13

Fixed

• Code samples corrupted by content cleaning — HTML/JSX tag stripping, import removal (excludeImports), image-URL rewriting, and title detection now skip fenced code blocks and inline code, so examples shown in code blocks are preserved verbatim.
• Global version option ignored — it's now included in llms.txt/llms-full.txt (previously only per-custom-file version worked).
• draft: "true" — quoted-string frontmatter is now skipped like the boolean true.
• MDX/JSX component tags — tags like <Tabs>/<TabItem> are now stripped from generated text, keeping their inner content.
• Custom-file includeUnmatchedLast — now defaults to true (matching standard files), so includePatterns-selected docs aren't dropped when orderPatterns doesn't list them.
• pathTransformation.ignorePaths — no longer leaves a trailing slash when removing a terminal segment, and tolerates entries written with a trailing slash.
• buildImageAssetMap — no longer indexes non-image build assets.

[0.4.4] - 2026-07-13

Fixed

• .md links returning 404 (#41) — addMdExtension appended .md to llms.txt links by default, but the .md files are only produced when generateMarkdownFiles is enabled, so the links pointed to files that didn't exist. .md is now appended only when the markdown files are actually generated; otherwise links point to the normal doc routes.

... (truncated)

Commits

• 09a6fe4 refactor: extract shared numberPrefix module; cover numeric title
• 63626f1 fix: coerce numeric frontmatter slug/id to string (#58)
• fae981a chore: Release v0.5.1 — path/route-resolution fixes (#59)
• 64efdc9 Merge pull request #59 from AlexAdiaconitei/main
• d7beaf5 fix: prioritize frontmatter slug/id over filename heuristic
• 80d3fab fix: strip compound number prefixes to match Docusaurus routes
• f55b6c4 fix: write generated markdown to a baseUrl-relative path
• a2a23a0 Merge PR #56: multi-version llms output via versions option
• 306baba feat: multi-version llms output via versions option
• 2a33fca Merge PR #57: resolve @​site partials via siteDir
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Assignees

The following users could not be added as assignees: protocol-galileo. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
metamask-docs	Ready	Preview	Aug 23, 2026 4:15am

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	docusaurus-plugin-llms@​0.2.2 ⏵ 0.5.1	+1		+1	+8

View full report

[socket-security]

Caution

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		High CVE: npm minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions CVE: GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions (HIGH) Affected versions: >= 10.0.0 < 10.2.3; >= 9.0.0 < 9.0.7; >= 8.0.0 < 8.0.6; >= 7.0.0 < 7.4.8; >= 6.0.0 < 6.2.2; >= 5.0.0 < 5.1.8; >= 4.0.0 < 4.2.5; < 3.1.4 Patched version: 9.0.7 From: package-lock.json → npm/docusaurus-plugin-llms@0.5.1 → npm/minimatch@9.0.3 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimatch@9.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		High CVE: npm minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments CVE: GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments (HIGH) Affected versions: >= 10.0.0 < 10.2.3; >= 9.0.0 < 9.0.7; >= 8.0.0 < 8.0.6; >= 7.0.0 < 7.4.8; >= 6.0.0 < 6.2.2; >= 5.0.0 < 5.1.8; >= 4.0.0 < 4.2.5; < 3.1.3 Patched version: 9.0.7 From: package-lock.json → npm/docusaurus-plugin-llms@0.5.1 → npm/minimatch@9.0.3 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimatch@9.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		High CVE: npm minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern CVE: GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern (HIGH) Affected versions: >= 10.0.0 < 10.2.1; >= 9.0.0 < 9.0.6; >= 8.0.0 < 8.0.5; >= 7.0.0 < 7.4.7; >= 6.0.0 < 6.2.1; >= 5.0.0 < 5.1.7; >= 4.0.0 < 4.2.4; < 3.1.3 Patched version: 9.0.6 From: package-lock.json → npm/docusaurus-plugin-llms@0.5.1 → npm/minimatch@9.0.3 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimatch@9.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Medium CVE: npm yaml is vulnerable to Stack Overflow via deeply nested YAML collections CVE: GHSA-48c2-rrv3-qjmp yaml is vulnerable to Stack Overflow via deeply nested YAML collections (MODERATE) Affected versions: >= 2.0.0 < 2.8.3; >= 1.0.0 < 1.10.3 Patched version: 2.8.3 From: package-lock.json → npm/docusaurus-plugin-llms@0.5.1 → npm/yaml@2.8.1 ℹ Read more on: This package | This alert | What is a medium CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known medium severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yaml@2.8.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm minimatch is 65.0% likely to have a medium risk anomaly Notes: Selected Report 2 provides a solid, balanced view of typical glob-matching library risks, including ReDoS potential from RegExp generation and a minor note on environment-based platform handling. An improved assessment confirms no evidence of malware or exfiltration; main concerns are regex-complexity with untrusted inputs and cautious use of environment-driven behavior. Recommended risk controls: validate/sanitize incoming patterns, consider limiting pattern complexity, enable security-conscious flags (e.g., no nocase abuse if not needed), and avoid exposing verbose debug logs in production. Confidence: 0.65 Severity: 0.52 From: package-lock.json → npm/docusaurus-plugin-llms@0.5.1 → npm/minimatch@9.0.3 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimatch@9.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm yaml is 70.0% likely to have a medium risk anomaly Notes: The code fragment is a sophisticated, non-malicious YAML parser component with extensive state management for documents, maps, sequences, and flows. There is no evidence of malware, backdoors, or data leakage within this isolated module. Security risk is moderate due to parsing complexity (potential for parser bugs), but no active threat indicators detected in this excerpt. Confidence: 0.70 Severity: 0.52 From: package-lock.json → npm/docusaurus-plugin-llms@0.5.1 → npm/yaml@2.8.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yaml@2.8.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report