Repository navigation
fix(deps): resolve 3 js-yaml Dependabot alerts (js-yaml 4.1.1 -> 4.3.1) - #99
Merged
Merged
Conversation
Three open alerts all concern the same transitive js-yaml 4.x copies, which Antora nests under three of its packages: - js-yaml 4.1.1 -> 4.3.1 in @antora/content-aggregator, @antora/playbook-builder and @antora/ui-loader - #10 high — quadratic CPU consumption in !!omap resolution (CVE-2026-59870 not backported), needs >= 4.3.1 - #9 high — YAML merge-key chains force quadratic CPU, needs >= 4.3.0 - #8 medium — quadratic-complexity DoS in merge key handling via repeated aliases, needs >= 4.2.0 The direct js-yaml dependency is already 5.3.0 and is not in any vulnerable range, so a blanket override is wrong here: it would downgrade the safe 5.x direct dependency to the 4.x legacy line. Two major lines are live at once, so the pin is applied per parent instead, leaving the root dependency at 5.3.0. The three Antora packages declare "js-yaml": "~4.1", which cannot reach 4.3.1, and Antora's latest stable release (3.1.15) is already in use — only 3.2.0 pre-releases exist upstream. Overrides are therefore the only route to the patched version without moving to a pre-release Antora. Verified under Node 22 (the version CI uses; the local default is 18): npm ci, npm run antora (exit 0), npm test (17/17 pass), npm run pagefind. The 29 xref errors in the Antora log are pre-existing content issues on main (stale "next@ocis:ROOT:" targets) and are non-fatal — no failure_level is configured in site.yml. All three alerts are fixable and fixed; none are left without a fix. They remain open until this lands on the default branch. Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
jvillafanez
approved these changes
Aug 21, 2026
kw-tmueller
pushed a commit
that referenced
this pull request
Sep 8, 2026
Antora 3.2.0 migrated to js-yaml 5: @antora/playbook-builder,
@antora/content-aggregator and @antora/ui-loader now declare
`js-yaml: ~5.4` and use the js-yaml 5 API. The very first thing
playbook-builder does at module load is
const YAML_SCHEMA = yaml.CORE_SCHEMA.withTags(yaml.mergeTag)
and neither `CORE_SCHEMA.withTags` nor `mergeTag` exists in js-yaml 4,
so `npm run antora` died with
TypeError: yaml.CORE_SCHEMA.withTags is not a function
before it ever read the playbook.
The overrides pinning js-yaml 4.3.1 into those three packages came from
#99, as a workaround for Antora 3.1.15 depending on the vulnerable `~4.1`
line. Antora 3.2.0 makes them obsolete: it resolves js-yaml 5.4.1 on its
own, which is the version this repo already declares as a direct
dependency, so #99's security goal still holds with no override at all.
Keeping them only downgrades Antora into a library it no longer supports.
Removing them leaves a single hoisted js-yaml 5.4.1 and no nested copies.
`npm audit` reports no js-yaml advisories.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
phil-davis
pushed a commit
that referenced
this pull request
Sep 8, 2026
…group (#116) * chore(deps): Bump antora in the npm-minor-patch group Bumps the npm-minor-patch group with 1 update: [antora](https://gitlab.com/antora/antora/tree/HEAD/packages/antora). Updates `antora` from 3.1.15 to 3.2.0 - [Changelog](https://gitlab.com/antora/antora/blob/main/CHANGELOG.adoc) - [Commits](https://gitlab.com/antora/antora/compare/v3.1.15...v3.2.0) --- updated-dependencies: - dependency-name: antora dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com> * fix(deps): drop the obsolete js-yaml overrides for antora 3.2.0 Antora 3.2.0 migrated to js-yaml 5: @antora/playbook-builder, @antora/content-aggregator and @antora/ui-loader now declare `js-yaml: ~5.4` and use the js-yaml 5 API. The very first thing playbook-builder does at module load is const YAML_SCHEMA = yaml.CORE_SCHEMA.withTags(yaml.mergeTag) and neither `CORE_SCHEMA.withTags` nor `mergeTag` exists in js-yaml 4, so `npm run antora` died with TypeError: yaml.CORE_SCHEMA.withTags is not a function before it ever read the playbook. The overrides pinning js-yaml 4.3.1 into those three packages came from #99, as a workaround for Antora 3.1.15 depending on the vulnerable `~4.1` line. Antora 3.2.0 makes them obsolete: it resolves js-yaml 5.4.1 on its own, which is the version this repo already declares as a direct dependency, so #99's security goal still holds with no override at all. Keeping them only downgrades Antora into a library it no longer supports. Removing them leaves a single hoisted js-yaml 5.4.1 and no nested copies. `npm audit` reports no js-yaml advisories. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves all three open Dependabot alerts on this repo. They are all the same
package: the transitive
js-yaml4.x copies that Antora nests under three ofits packages.
Fixed
js-yaml(under@antora/content-aggregator)js-yaml(under@antora/playbook-builder)js-yaml(under@antora/ui-loader)!!omapresolution; CVE-2026-59870 fix not backported. Needs ≥ 4.3.1.4.3.1 clears all three thresholds.
Why per-parent overrides instead of one pin
Two major lines of
js-yamlare live in this tree at once:^5.3.0→ resolves to 5.3.0, which is not in any vulnerable range;@antora/*packages were 4.1.1.A blanket
"js-yaml": "4.3.1"override would have downgraded the healthy 5.xdirect dependency onto the 4.x legacy line, so the pin is scoped per parent and
the root dependency is left at 5.3.0.
The three Antora packages declare
"js-yaml": "~4.1", which cannot reach 4.3.1on its own, and Antora's latest stable release (3.1.15) is already in use —
only 3.2.0 pre-releases exist upstream. Overrides are therefore the only way to
the patched version without adopting a pre-release Antora. (4.3.1 is published
upstream under the
v4-legacydist-tag.)Not fixable
None — all three alerts have an upstream fix and it is applied here.
Test plan
Run under Node 22, matching
.github/workflows/ci.yml(the local default isNode 18, which several deps no longer support):
npm ci— clean install from the lockfile, 0 vulnerabilitiesnpm run antora— exit 0,public/index.htmlproducednpm test— 17/17 passnpm run pagefind— exit 0, 486 pages indexedThe 29
xref not founderrors in the Antora log are pre-existing onmain(stale
next@ocis:ROOT:targets, last touched by a docs-main sync) and arenon-fatal — no
failure_levelis set insite.yml.Note for reviewers
The alerts stay open on the security page until this merges into
main; that isexpected and not a sign the fix did not take.
🤖 Generated with Claude Code