From d684d38f1f7cb99e2be826ec630482e4adb66112 Mon Sep 17 00:00:00 2001
From: Natalia Ivakina <82437520+NataliaIvakina@users.noreply.github.com>
Date: Wed, 5 Aug 2026 16:18:56 +0200
Subject: [PATCH 1/2] Update version from 2026.06 to 2026.07

---
 antora.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/antora.yml b/antora.yml
index 4176312..fb67097 100644
--- a/antora.yml
+++ b/antora.yml
@@ -1,6 +1,6 @@
 name: http-api
 title: HTTP API
-version: '2026.06'
+version: '2026.07'
 start_page: ROOT:index.adoc
 nav:
 - modules/ROOT/content-nav.adoc

From 31a7b0d1829ac04c84eee1a48f3fc5926b1e2853 Mon Sep 17 00:00:00 2001
From: Natalia Ivakina <82437520+NataliaIvakina@users.noreply.github.com>
Date: Wed, 5 Aug 2026 16:40:30 +0200
Subject: [PATCH 2/2] Upstream/natalia ivakina patch 2 (#175)

Co-authored-by: Reneta Popova <reneta.popova@neo4j.com>
Co-authored-by: Neil Dewhurst <neil.dewhurst@neo4j.com>
---
 .github/workflows/docs-deploy-surge.yml | 49 ++++++++++++++++++++++---
 publish.yml                             |  3 ++
 2 files changed, 47 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/docs-deploy-surge.yml b/.github/workflows/docs-deploy-surge.yml
index 9278cd6..ed483e1 100644
--- a/.github/workflows/docs-deploy-surge.yml
+++ b/.github/workflows/docs-deploy-surge.yml
@@ -22,7 +22,7 @@ on:
       - completed
 
 jobs:
-  # [Optional] Restrict automatic dpeloyment to PRs from the upstream repo
+  # [Optional] Restrict automatic deployment to PRs from the upstream repo
   # For fork PRs, requires manual approval via the "preview" environment.
   # For PRs from the main repository this job is skipped and deploy-docs runs immediately.
   # Setup: create a "preview" environment in Settings → Environments with required reviewers.
@@ -56,7 +56,7 @@ jobs:
             var artifacts = await github.rest.actions.listWorkflowRunArtifacts({
                owner: context.repo.owner,
                repo: context.repo.repo,
-               run_id: ${{ env.RUN_ID }},
+               run_id: process.env.RUN_ID,
             });
 
             var matchArtifactDocs = artifacts.data.artifacts.filter((artifact) => {
@@ -86,13 +86,32 @@ jobs:
 
       - id: suspicious-path-check
         name: Suspicious paths check
+        shell: bash
         env:
           ARTIFACT_DIR: ${{ runner.temp }}/artifacts/docs
         run: |
+          set -euo pipefail
           cd "$ARTIFACT_DIR"
-          if unzip -l docs.zip | grep -q "\.\./"; then
+          
+          mapfile -t ZIP_ENTRIES < <(zipinfo -1 docs.zip)
+          if [ "${#ZIP_ENTRIES[@]}" -eq 0 ]; then
+            echo "docs.zip is empty"
             exit 1
           fi
+          for entry in "${ZIP_ENTRIES[@]}"; do
+            if [[ "$entry" =~ ^/ ]]; then
+              echo "Blocked absolute path in artifact: $entry"
+              exit 1
+            fi
+            if [[ "$entry" =~ (^|/)\.\.(/|$) ]]; then
+              echo "Blocked path traversal in artifact: $entry"
+              exit 1
+            fi
+            if [[ "$entry" == *\\* ]]; then
+              echo "Blocked Windows-style path separator in artifact: $entry"
+              exit 1
+            fi
+          done
 
       - id: hidden-files-check
         name: Hidden files check
@@ -132,6 +151,26 @@ jobs:
           cd "$ARTIFACT_DIR"
           unzip changelog.zip
 
+      # The changelog file is built from untrusted PR content and its contents
+      # are posted to the PR as a comment. A malicious artifact could make
+      # `changelog` a symlink pointing at an arbitrary file the runner can read,
+      # turning the comment step into an arbitrary-file-read. Reject anything
+      # that isn't a plain regular file before we read it.
+      - id: validate-changelog
+        name: Validate changelog is a regular file
+        if: ${{ steps.find-changelog.outputs.has-changelog == 'true' }}
+        env:
+          CHANGELOG_FILE: ${{ runner.temp }}/artifacts/changelog/changelog
+        run: |
+          if [ -L "$CHANGELOG_FILE" ]; then
+            echo "Security Alert: changelog is a symlink — refusing!"
+            exit 1
+          fi
+          if [ ! -f "$CHANGELOG_FILE" ]; then
+            echo "changelog missing or not a regular file"
+            exit 1
+          fi
+
       - id: get-deploy-id
         name: Get deploy ID
         env:
@@ -150,7 +189,7 @@ jobs:
         run: |
           deployurl=$ORG-$REPO-$DEPLOYID.surge.sh
           echo "deploy-url=$deployurl" >> $GITHUB_OUTPUT
-
+      
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: lts/*
@@ -165,7 +204,7 @@ jobs:
           mkdir -p "$DOCS_DEPLOY_DIR"
           # Copy only the built docs into a clean directory for deployment
           cp -R "$DOCS_SRC_DIR"/. "$DOCS_DEPLOY_DIR"/
-
+      
       - id: surge-deploy
         name: Deploy docs to surge
         shell: bash
diff --git a/publish.yml b/publish.yml
index 8d139a0..746f8ef 100644
--- a/publish.yml
+++ b/publish.yml
@@ -34,6 +34,9 @@ asciidoc:
   - "@neo4j-documentation/macros"
   - "@neo4j-antora/mark-terms"
   attributes:
+    page-tabs: drivers-apis@
+    page-tabs-index: 40
+    page-tabs-group: dbms
     page-theme: docs
     page-type: Docs
     page-search-type: Docs