[kemister85]

Ticket: TINYDOC-3709

Site: Staging branch

What was broken: 23 open Dependabot alerts on main, all transitive development dependencies of the docs build. Antora 3.1.x pins isomorphic-git ~1.25 and js-yaml ~4.1, so those could not reach patched versions; the rest were stale lockfile entries.

What is fixed: yarn audit reports 0 vulnerabilities. The built site is unchanged except for one tinymce/6 nav entry: 6.7.2 > Security fixes now renders as plain text instead of a link, because the tinymce/6 nav.adoc has a stray * (**** * xref:...) that Antora 3.1 tolerated and 3.2 does not.

How:

• package.json: @antora/cli and @antora/site-generator-default to ^3.2.2; liquidjs resolution to >=10.27.2.
• yarn.lock: re-resolved the flagged packages (isomorphic-git 1.38.10, js-yaml 5.4.3/4.3.2, handlebars 4.7.10, liquidjs 10.30.1, shell-quote, follow-redirects, brace-expansion, form-data, ws, qs).

Note: Antora 3.2 requires Node 20 or later; the workflows already use Node 22/24. A follow-up applies the same change to tinymce/8.

Pre-checks:

• Branch prefixed with feature/<version>/, hotfix/<version>/, staging/<version>/, or release/<version>/.
• modules/ROOT/nav.adoc has been updated (if applicable).
• Included a release note entry for any New product features.
• If this is a minor release, updated productminorversion in antora.yml and added new supported versions entry in modules/ROOT/partials/misc/supported-versions.adoc.

Review:

• Documentation Team Lead has reviewed