[kemister85]

Ticket: TINYDOC-3709

Site: Staging branch

What was broken: the tinymce/8 lockfile had about 20 vulnerable transitive development dependencies (isomorphic-git, handlebars, liquidjs, convict, sha.js, sanitize-html and others). This is the tinymce/8 counterpart of #4441.

What is fixed: yarn audit reports 0 vulnerabilities. The built site is unchanged except for one tinymce/6 nav entry: 6.7.2 > Security fixes now renders as plain text instead of a link, because the tinymce/6 nav.adoc has a stray * (**** * xref:...) that Antora 3.1 tolerated and 3.2 does not.

How:

• package.json: @antora/cli and @antora/site-generator-default to ^3.2.2; http-server to ^14.1.1 (as on main, drops the unpatchable ecstatic 3.x); added the liquidjs resolution >=10.27.2 from main.
• yarn.lock: refreshed within existing ranges, keeping nodemon at 3.1.10 and @asciidoctor/core at 2.2.6 to match main (newer versions add an unpatched minimatch and change page rendering).

Pre-checks:

• Branch prefixed with feature/<version>/, hotfix/<version>/, staging/<version>/, or release/<version>/.
• modules/ROOT/nav.adoc has been updated (if applicable).
• Included a release note entry for any New product features.
• If this is a minor release, updated productminorversion in antora.yml and added new supported versions entry in modules/ROOT/partials/misc/supported-versions.adoc.

Review:

• Documentation Team Lead has reviewed