Update dependencies and close security vulnerabilities

[JulianKniephoff]

Not high priority at all, but as part of basically taking over this repository I wanted to update some things just now and ran into a few problems:

• npm update updates some internal Webpack component, leading to Build failing after webpack upgraded to v5.106.0 at Apr 8, 2026, 8:41 PM GMT+5:30 facebook/docusaurus#11923
• Updating TypeScript I ran into @docusaurus/tsconfig: baseUrl is deprecated in TypeScript 6.0 (TS5101) facebook/docusaurus#11893, necessitating an ugly flag: 3f4e1cc#diff-b55cdbef4907b7045f32cc5360d48d262cca5f94062e353089f189f4460039e0R4-R6
  • This can go away once (and only once) we update to Docusaurus v4.
• The two (current) vulnerabilities reported by Dependabot (https://github.com/opencast/data-model/security/dependabot/13 and https://github.com/opencast/data-model/security/dependabot/15) could be fixed by upgrading serialize-javascript to 7.something, or waiting for the project to backport the fix to the v6 branch.
  • The former would need an override on our side, which I'm not sure I want to maintain; alternatively we wait for Docusaurus v4 again: Upgrade serialize-javascript to ≥7.0.4 to resolve high severity RCE vulnerability facebook/docusaurus#11801
  • The latter is tracked here: Backport of GHSA-5c6j-r48x-rmvq to version 6 yahoo/serialize-javascript#208

[mtneug]

While I like Docusaurus, I have not found it particularly useful it in this repository. Can't we just reduce this repository to plain Markdown files and no longer worry about version updates?

[JulianKniephoff]

We talked about looking at alternatives internally already; maybe something where we could have discussions inline (in the rendered version) instead of in PRs. Just sticking with plain .md is certainly an option, too. I'll keep it in mind as I work my way deeper into this. 🙈

[LukasKalbertodt]

We could also disable depandabot, security vulnerability checking and just not update anything. It really doesn't matter for this case. Especially since it will very likely be transferred to another doc system at some point.