From 28d28e17715f3908a81daea225093bf64412252a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20M=C3=BCller?=
 <1005065+DeepDiver1975@users.noreply.github.com>
Date: Fri, 21 Aug 2026 13:33:19 +0200
Subject: [PATCH] fix(deps): resolve 3 js-yaml Dependabot alerts (js-yaml 4.1.1
 -> 4.3.1)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three open alerts all concern the same transitive js-yaml 4.x copies, which
Antora nests under three of its packages:

- js-yaml 4.1.1 -> 4.3.1 in @antora/content-aggregator,
  @antora/playbook-builder and @antora/ui-loader
  - #10 high   — quadratic CPU consumption in !!omap resolution
                 (CVE-2026-59870 not backported), needs >= 4.3.1
  - #9  high   — YAML merge-key chains force quadratic CPU, needs >= 4.3.0
  - #8  medium — quadratic-complexity DoS in merge key handling via
                 repeated aliases, needs >= 4.2.0

The direct js-yaml dependency is already 5.3.0 and is not in any vulnerable
range, so a blanket override is wrong here: it would downgrade the safe 5.x
direct dependency to the 4.x legacy line. Two major lines are live at once,
so the pin is applied per parent instead, leaving the root dependency at
5.3.0.

The three Antora packages declare "js-yaml": "~4.1", which cannot reach
4.3.1, and Antora's latest stable release (3.1.15) is already in use — only
3.2.0 pre-releases exist upstream. Overrides are therefore the only route to
the patched version without moving to a pre-release Antora.

Verified under Node 22 (the version CI uses; the local default is 18):
npm ci, npm run antora (exit 0), npm test (17/17 pass), npm run pagefind.
The 29 xref errors in the Antora log are pre-existing content issues on main
(stale "next@ocis:ROOT:" targets) and are non-fatal — no failure_level is
configured in site.yml.

All three alerts are fixable and fixed; none are left without a fix. They
remain open until this lands on the default branch.

Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
---
 package-lock.json | 53 +++++++++++++++++++++++++++++++++++------------
 package.json      |  9 ++++++++
 2 files changed, 49 insertions(+), 13 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e5521b2..7a1df1d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,5 +1,5 @@
 {
-  "name": "owncloud-docs-monorepo",
+  "name": "docs.owncloud.com",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
@@ -90,10 +90,19 @@
       }
     },
     "node_modules/@antora/content-aggregator/node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
-      "license": "MIT",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
       "dependencies": {
         "argparse": "^2.0.1"
       },
@@ -209,10 +218,19 @@
       }
     },
     "node_modules/@antora/playbook-builder/node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
-      "license": "MIT",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
       "dependencies": {
         "argparse": "^2.0.1"
       },
@@ -305,10 +323,19 @@
       }
     },
     "node_modules/@antora/ui-loader/node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
-      "license": "MIT",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
       "dependencies": {
         "argparse": "^2.0.1"
       },
diff --git a/package.json b/package.json
index 9ff5e32..b7e0fee 100644
--- a/package.json
+++ b/package.json
@@ -24,6 +24,15 @@
   "overrides": {
     "asciidoctor-opal-runtime": {
       "glob": "~10.4"
+    },
+    "@antora/content-aggregator": {
+      "js-yaml": "4.3.1"
+    },
+    "@antora/playbook-builder": {
+      "js-yaml": "4.3.1"
+    },
+    "@antora/ui-loader": {
+      "js-yaml": "4.3.1"
     }
   }
 }