build(deps): Bump @docsearch/react from 4.7.0 to 5.0.1

[dependabot]

Bumps @docsearch/react from 4.7.0 to 5.0.1.

Release notes

Sourced from @​docsearch/react's releases.

@​docsearch/react@​5.0.0

Major Changes

• ecd905d: # DocSearch v5-beta

  DocSearch v5 is a major release that introduces AI-powered answers via Agent Studio, a refreshed search UI, and a modernized package architecture.

  Ask AI & Agent Studio

  • Agent Studio integration with core tools and dynamic tool calls
  • Conversation memory support
  • Compatibility with the Algolia MCP search tool, with aggregated MCP search tool calls
  • Dynamic index selection for Agent Studio
  • Feedback integration, including feedback notes and tags
  • Prompt suggestions in keyword search and follow-up prompt suggestions
  • Ask AI modal split into its own component and Ask AI transport layer removed

  Search UI

  • Refreshed v5 UI with improved dark theme, sources panel, and accessibility
  • Faceted search with filter chips
  • Hit breadcrumbs and result badges

  Packaging & architecture

  • New @docsearch/cli package for MCP setup and search
  • MCP plugin support
  • Split JS bundles for search-only usage and JS-based hybrid mode
  • Migrated the build system to tsdown
  • Migrated CSS building to LightningCSS

  Breaking changes

  • Ask AI related props are now nested under a single root askai option
  • The Ask AI transport layer has been removed

Patch Changes

• ecd905d: feat(v5): General UI styling updates and fixes

  • New --docsearch-font-family variable, used by the search button, keyboard keys, modal, and sidepanel. It replaces the system font stacks that were duplicated across sidepanel.css and button.css, so overriding one variable now themes every DocSearch surface
  • The search input and modal heading are 1rem at every breakpoint (previously 0.875rem with a mobile-only override)
  • .DocSearch-Title uses line-height: 1.5em instead of 0.5em and adds overflow-wrap: anywhere, so long titles wrap instead of overlapping (#2908)

... (truncated)

Changelog

Sourced from @​docsearch/react's changelog.

5.0.1

Patch Changes

• 4ac53c4: Fixes missing published export for keyword only <DocSearch /> that was missed in #2884.
  • @​docsearch/css@​5.0.1
  • @​docsearch/core@​5.0.1

5.0.0

Major Changes

• ecd905d: # DocSearch v5-beta

  DocSearch v5 is a major release that introduces AI-powered answers via Agent Studio, a refreshed search UI, and a modernized package architecture.

  Ask AI & Agent Studio

  • Agent Studio integration with core tools and dynamic tool calls
  • Conversation memory support
  • Compatibility with the Algolia MCP search tool, with aggregated MCP search tool calls
  • Dynamic index selection for Agent Studio
  • Feedback integration, including feedback notes and tags
  • Prompt suggestions in keyword search and follow-up prompt suggestions
  • Ask AI modal split into its own component and Ask AI transport layer removed

  Search UI

  • Refreshed v5 UI with improved dark theme, sources panel, and accessibility
  • Faceted search with filter chips
  • Hit breadcrumbs and result badges

  Packaging & architecture

  • New @docsearch/cli package for MCP setup and search
  • MCP plugin support
  • Split JS bundles for search-only usage and JS-based hybrid mode
  • Migrated the build system to tsdown
  • Migrated CSS building to LightningCSS

  Breaking changes

  • Ask AI related props are now nested under a single root askai option
  • The Ask AI transport layer has been removed

Patch Changes

• ecd905d: feat(v5): General UI styling updates and fixes

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Dependency-only bump with no application integration changes; main follow-up is verifying build and that no hidden DocSearch v5 API or bundle issues appear at runtime.

Overview
Bumps the direct dependency @docsearch/react from 4.7.0 to 5.0.1 in package.json, with a matching package-lock.json refresh.

DocSearch v5 is a major release: refreshed search UI, optional Ask AI / Agent Studio plumbing, and new runtime dependencies (e.g. ai, @ai-sdk/react, @base-ui/react, zod). There are no edits to docusaurus.config.js or other app source in this diff—site search is still configured via @easyops-cn/docusaurus-search-local, and nothing in the repo imports @docsearch/react directly.

The lockfile still nests 4.7.0 @docsearch/react under @docusaurus/theme-search-algolia, so the tree may carry both major versions until Docusaurus aligns its Algolia theme peer range.

^{Reviewed by Cursor Bugbot for commit fa0b9fb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​docsearch/​react@​5.0.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm json-schema is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@docsearch/react@5.0.1 → npm/json-schema@0.4.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/json-schema@0.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review this Dependabot bump for supply-chain compromise indicators, starting with the scan findings, lockfile/manifest changes, and upstream package evidence.The scanner flagged a missing 5.0.1 tag; checking whether that tag exists upstream and inspecting the published package for suspicious scripts or payloads.Verdict: benign

Evidence

• Official Algolia package: npm @docsearch/react@5.0.1 is published, signed, and gitHead matches upstream release commit e9f932b7 (chore: release v5.0.1). Maintainers are the same Algolia accounts as 4.7.0 / 5.0.0.
• Lockfile integrity matches the registry tarball (sha512-0gP+… exact match). No install/preinstall/postinstall scripts on @docsearch/*; only normal build/watch.
• Tarball review: no obfuscation, no unexpected C2 hosts, no persistence/process spawn. Network endpoints are Algolia/docs/CDN-related. Apparent \ufeff hits are BOM-stripping logic, not hidden payload.
• New deps (ai, @ai-sdk/react, @base-ui/react, zod, marked, etc.) align with the documented v5 Ask AI / UI rewrite, not a sudden unexplained graph explosion with malware-shaped scripts.

Scanner disagreement

• ghost_version_or_missing_tag / unresolved to= are scanner resolution gaps: local upstream tags include @docsearch/react@5.0.0 but not @docsearch/react@5.0.1, while npm has 5.0.1 (and 5.0.2) tied to the real release commit. Treat as false positive, not compromise.
• version_jump_anomaly (4.7.0→5.0.1) is an expected major bump with published release notes; not malware by itself.

No supply-chain malware indicators found for this update.

Compatibility Analysis

I'll analyze how @docsearch/react is used in this repo and whether the 4.7.0 → 5.0.1 major bump is compatible.## Compatibility verdict: hold

1) Usage in this repo

• Declared as a direct dependency in package.json / lockfile (@docsearch/react@5.0.1).
• No application imports of @docsearch/react / DocSearch under src/, and no DocSearch CSS overrides.
• Search is @easyops-cn/docusaurus-search-local in docusaurus.config.js — no themeConfig.algolia.
• Transitive only: @docusaurus/theme-search-algolia@3.10.2 still nests @docsearch/react@4.7.0 because it allows ^3.9.0 || ^4.3.2 (not v5).

2) Intersection with v5 API changes

• Documented breakages (askai nesting, Ask AI transport removed, UI/CSS/export splits) affect direct DocSearch API consumers.
• This repo does not call those APIs, so there is no usage-site collision today.
• If anything later forced Docusaurus’s Algolia theme onto v5, that would be unsupported by its declared range.

3) Risks / unknowns

• Dead major upgrade: installs a larger v5 tree (@ai-sdk/react, ai, zod, marked, @base-ui/react, etc.) without product benefit.
• Dual versions in the lockfile (top-level 5.0.1 + nested 4.7.0) — confusing and expands supply-chain surface.
• Future footgun if someone enables Algolia DocSearch or npm-hoists v5 into @docusaurus/theme-search-algolia.
• Low immediate runtime risk for the current local-search setup; build impact should be limited to install size/deps, not search UX.

4) Recommendation

Hold. Prefer ignoring this major (or removing the unused direct dep) until either (a) you intentionally adopt DocSearch/Algolia and migrate, or (b) Docusaurus’s Algolia theme officially supports @docsearch/react v5.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 0
• Resolution strategy: unresolved
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved refs: from=3f2b6e2fdf15c9d22d5d67195fca7b1596815a7e to=n/a
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 2

Top findings

• @docsearch/react:0 ghost_version_or_missing_tag :: 5.0.1
• @docsearch/react:0 version_jump_anomaly :: 4.7.0->5.0.1

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit fa0b9fb. Configure here.}

[cursor]

Incompatible DocSearch major bump

Medium Severity

Bumping @docsearch/react to ^5.0.1 puts it outside @docusaurus/theme-search-algolia’s supported range (^3.9.0 || ^4.3.2). The lockfile now installs unused root v5 (plus AI SDK, zod, marked) while nesting v4.7.0 for Docusaurus. This site uses @easyops-cn/docusaurus-search-local and never imports DocSearch, so the major bump adds supply-chain weight and version split without delivering v5 support.

Additional Locations (2)

• package-lock.json#L3502-L3517
• package-lock.json#L4151-L4154

 

^{Reviewed by Cursor Bugbot for commit fa0b9fb. Configure here.}