Docs Deploy fails on stable releases: js-yaml 4 override breaks gray-matter front-matter parsing

[steilerDev]

Bug

The Docs Deploy job in release.yml has failed on the last two stable releases (v2.12.0 run 28778826343, and the 2026-06-20 release run 27862889701). The docs site has not deployed since.

Root cause

PR #1733 added a root npm override pinning js-yaml to 4.2.0 for all transitive consumers to remediate CVE-2026-53550. Docusaurus parses markdown front matter via gray-matter@4.0.3, which calls yaml.safeLoad — an API removed in js-yaml 4. The docs build fails with:

[ERROR] Error while parsing Markdown front matter.
[cause]: Error: Function yaml.safeLoad is removed in js-yaml 4. Use yaml.load instead

Fix

Per GHSA advisory for CVE-2026-53550, the 3.x line is patched in 3.15.0. Scope the override so gray-matter gets the patched 3.x (keeps the safeLoad API) while everything else stays on 4.2.0:

"overrides": {
  "js-yaml": "4.2.0",
  "gray-matter": { "js-yaml": "3.15.0" }
}

No security regression: 3.15.0 is the patched version for the 3.x range.

[orchestrator] Filed during the v2.12.0 /release post-merge verification.

[steilerDev]

[orchestrator] Resolved in PR #1854 (squash-merged to beta). The js-yaml override is now scoped: gray-matter resolves the GHSA-patched 3.15.0 (keeping the yaml.safeLoad API it needs) while every other consumer stays on 4.2.0 — verified via the GHSA advisory data (both patch lines confirmed), npm ls resolution, a full lockfile advisory scan (0 findings across 1,781 packages), and a successful local npm run docs:build (the exact failure from the last two release runs). Docs Deploy should succeed on the next stable release. Will reach main with the next beta promotion.

[github-actions]

🎉 This issue has been resolved in version 2.13.0-beta.23 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀