refactor(frontmatter): constrain frontmatter object after parsing

This change removes the meta-marked dependency which solely was
used for extracting the frontmatter, which is possible as well
with one function. Furthermore, this introduces constraints to
objects resulting from frontmatter parsing and enforces them in
order to prevent attacks like a yaml bomb (massive alias expansion).
This change should resolve a possible DoS attack.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>

public/docs/release-notes.md

@@ -16,6 +16,10 @@ Thanks to [Chandler Johnson](https://github.com/chndlrx) for reporting!
 - Allow configuration of login / signup rate-limits
 - Allow configuration of Cloudflare usage in regards rate-limits
 
+### Bugfixes
+
+- Made frontmatter parsing resilient to massive YAML alias expansion ("YAML bomb")
+
 ## <i class="fa fa-tag"></i> 1.10.8 <i class="fa fa-calendar-o"></i> 2026-04-15
 
 ### Bugfixes

public/js/extra.js

@@ -1247,7 +1247,11 @@ function meta (state, start, end, silent) {
   if (line >= end) return false
 
   try {
-    md.meta = window.jsyaml.safeLoad(data.join('\n')) || {}
+    const parsed = window.jsyaml.load(data.join('\n')) || {}
+    md.meta = window.ConstrainObject.constrainObject(parsed, {
+      onCycle: 'omit',
+      maxDepth: 4
+    })
     delete md.metaError
   } catch (err) {
     md.metaError = err

public/views/includes/scripts.ejs

@@ -1,4 +1,5 @@
 <script src="config"></script>
+<script src="build/constrain-object.min.js"></script>
 <% for (var js in htmlWebpackPlugin.files.js) { %>
 <script src="<%= htmlWebpackPlugin.files.js[js] %>" defer></script>
 <% } %>

public/views/pretty.ejs

@@ -15,7 +15,7 @@
     <meta name="description" content="<%= description %>">
     <% } %>
     <% for (var og in opengraph) { %>
-    <% if (opengraph.hasOwnProperty(og) && opengraph[og].trim() !== '') { %>
+    <% if (opengraph.hasOwnProperty(og) && typeof opengraph[og] === 'string' && opengraph[og].trim() !== '') { %>
     <meta property="og:<%= og %>" content="<%= opengraph[og] %>">
     <% }} if (!opengraph.hasOwnProperty('image')) { %>
     <meta property="og:image" content="<%- serverURL %>/icons/android-chrome-512x512.png">