Fix: Remediate CVE-2026-53486

[Akash3121]

What is the motivation?

LFX Insights reported CVE-2026-53486 in this repository through the deprecated  decompress@4.2.1  package. https://nvd.nist.gov/vuln/detail/cve-2026-53486

The vulnerability affects archive extraction and may allow a crafted archive to create files, hard links, or symbolic links outside the intended destination directory. In this project, the vulnerable package was reachable through both Hugo wrapper dependencies:

hugo-cli@0.15.0
-> decompress@4.2.1

hugo-extended@0.123.8
-> careful-downloader@3.0.0
-----> decompress@4.2.1

Although this dependency is used while setting up the documentation build rather than by the deployed static website, removing it reduces the risk associated with downloading and extracting build tools.

This PR is part of an effort to address vulnerabilities reported for the project in LFX Insights through focused and reviewable changes.

What does this change do?

This change removes both dependency paths to the vulnerable  decompress  package.

• Removes  hugo-cli  from  package.json  and  package.hugo.json .
• Updates and pins  hugo-extended  to  0.153.1 .
• Regenerates  yarn.lock  without  decompress ,  careful-downloader , or  hugo-cli .
• Removes dependencies that became unused after the vulnerable wrappers were removed.
• Updates the local Hugo templates to use the service and embedded-partial APIs supported by Hugo 0.153.1.
• Preserves the existing Google Analytics, feedback, Disqus, documentation-list, and Swagger-list behavior through compatibility overrides for the currently pinned Docsy theme.

 hugo-cli was removed because it duplicated functionality already provided by  hugo-extended . Both packages registered a command named  hugo , which meant the project had two packages competing to provide the same executable. In addition,  hugo-cli directly introduced the vulnerable  decompress  dependency.

 hugo-extended@0.153.1 provides both  hugo  and  hugo-extended  command aliases, so existing commands such as  yarn hugo continue to work without the separate  hugo-cli  package. The Extended Hugo distribution also retains the asset-processing features required by the Docsy-based website.

The resulting relevant dependency path is:

hugo-extended@0.153.1
-> adm-zip@0.5.18
-> tar@7.5.22

Is this related to any issues?

Nope, this PR addresses the CVE for this repo

Have you read the Contributing Guidelines?

• I have read the Contributing Guidelines

What is your testing strategy?

The following validation was completed locally:

1. Installed the updated dependency graph from a clean  node_modules  state.
2. Confirmed that the installation did not modify yarn.lock  or create a  package-lock.json .
3. Verified dependency consistency with:
   yarn check --verify-tree
4. Inspected the installed dependency tree and confirmed:

•  hugo-extended@0.153.1  is installed.
•  adm-zip@0.5.18  and  tar@7.5.22  are used by the updated wrapper.
•  decompress ,  careful-downloader , and  hugo-cli  are absent.

5. Verified that the installed executable is Hugo Extended 0.153.1.
6. Built the production site with minification enabled and confirmed that Hugo successfully generated:

• 169 pages
• 91 static files
• 60 aliases

yarn hugo `
   --renderToMemory `
   --minify `
   --themesDir ..\.. `
   --baseURL "https://example.invalid/"

7. Built the site with Google Analytics, the documentation feedback feature, and Disqus enabled.

$testOutput = Join-Path $env:TEMP "score-docs-feature-test"

if (Test-Path $testOutput) {
    Remove-Item -LiteralPath $testOutput -Recurse -Force
}

$env:HUGO_ENVIRONMENT = "production"
$env:HUGO_SERVICES_GOOGLEANALYTICS_ID = "G-TEST123"
$env:HUGO_PARAMS_UI_FEEDBACK_ENABLE = "true"
$env:HUGO_SERVICES_DISQUS_SHORTNAME = "review-test"

try {
    yarn hugo `
        --minify `
        --themesDir ..\.. `
        --baseURL "https://example.invalid/" `
        --destination $testOutput

    $article = Join-Path $testOutput "docs\how-to\github\index.html"

    Write-Output "Article exists: $(Test-Path $article)"
    Select-String -Path $article -Pattern 'feedback--title'
    Select-String -Path $article -Pattern 'review-test.disqus.com/embed.js'
}
finally {
    Remove-Item Env:HUGO_ENVIRONMENT -ErrorAction SilentlyContinue
    Remove-Item Env:HUGO_SERVICES_GOOGLEANALYTICS_ID -ErrorAction SilentlyContinue
    Remove-Item Env:HUGO_PARAMS_UI_FEEDBACK_ENABLE -ErrorAction SilentlyContinue
    Remove-Item Env:HUGO_SERVICES_DISQUS_SHORTNAME -ErrorAction SilentlyContinue
}

8. Confirmed in the generated article HTML that:

• The feedback component was rendered.
• The configured Disqus embed was rendered.

10. Started the Hugo development server and manually reviewed the site in a browser http://localhost:1313/docs/.

yarn hugo server `
    --themesDir ..\.. `
    --disableFastRender `
    --bind 127.0.0.1

12. Verified the documentation landing page, article pages, sidebar navigation, header, footer, code blocks, images, search, and responsive navigation.

14. Confirmed that the browser console contained no unexpected errors and that the tested CSS, JavaScript, image, and font requests completed successfully.
15. Ran  git diff --check  successfully

[Akash3121]

Hi @mathieu, the Compile Hugo/test workflow for this PR is awaiting maintainer approval before it can run. This PR addresses CVE-2026-53486 reported in LFX Insights. The dependency checks, Hugo production build, feature-enabled build, and browser smoke test have passed locally. Could you please review when you have a chance? Thank you!

[Akash3121]

Thanks for approving the workflow. I reviewed the failed run https://github.com/score-spec/docs/actions/runs/34081149161/job/101737341528?pr=325 and found that the failure is caused by a stale Hugo CLI flag in the existing Dockerfile.

This PR upgrades Hugo Extended from 0.123.0 to  0.153.1 . The previous version supported  --verbose , but Hugo  0.153.1  has removed that flag. The Docker image build therefore fails at:

RUN yarn hugo --verbose

with: ERROR command error: unknown flag: --verbose

The preceding dependency installation, regular Hugo build, formatting check, and Score Compose generation steps seems all passed. Therefore, this is not a failure in the CVE remediation itself; it is a compatibility issue exposed by the Hugo version upgrade.

I’ll update the Dockerfile to run  yarn hugo  without the obsolete flag.

[Akash3121]

Hi @mathieu, I’ve pushed the follow-up fix removing the unsupported  --verbose  flag from the Docker build. The new Compile Hugo workflow is awaiting approval again - Could you please approve the new run when you have a chance? Thank you!