From 4b66125d7fa964e8c6dea094c9dcbfc5e6dd513e Mon Sep 17 00:00:00 2001 From: michalharakal Date: Sun, 20 Sep 2026 18:16:44 +0200 Subject: [PATCH] security: override js-yaml to 4.3.2 in the docs image Committing the docs image lockfile made its npm graph visible to Dependabot: Antora and cosmiconfig resolve js-yaml 4.1.1 (GHSA-2883-xcg3-v3hh and three earlier quadratic-CPU advisories). An npm override pins 4.3.2; only that lockfile entry changes. Image rebuilt from scratch and the docs site renders unchanged. --- docs/.docker/package-lock.json | 16 +++++++++++++--- docs/.docker/package.json | 3 +++ 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/docs/.docker/package-lock.json b/docs/.docker/package-lock.json index 1dcc946d..23d3cf1e 100644 --- a/docs/.docker/package-lock.json +++ b/docs/.docker/package-lock.json @@ -3629,9 +3629,19 @@ "peer": true }, "node_modules/js-yaml": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", - "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], "license": "MIT", "dependencies": { "argparse": "^2.0.1" diff --git a/docs/.docker/package.json b/docs/.docker/package.json index 60eafc77..7a6cdea8 100644 --- a/docs/.docker/package.json +++ b/docs/.docker/package.json @@ -10,5 +10,8 @@ "@antora/site-generator": "3.1.15", "@mermaid-js/mermaid-cli": "github:mermaid-js/mermaid-cli#a85b11df7064498d5b6b97ee9b2d4a7c10cb42ae", "asciidoctor-kroki": "github:asciidoctor/asciidoctor-kroki#d02fbf06cdb837524f5e4e12537c05e0bb83c715" + }, + "overrides": { + "js-yaml": "4.3.2" } }