From 03428324aac15a065099711ff5049941977cbd09 Mon Sep 17 00:00:00 2001 From: Tom Boucher Date: Tue, 16 Jun 2026 09:28:52 -0400 Subject: [PATCH] =?UTF-8?q?chore(deps):=20bump=20js-yaml=20to=204.2.0=20?= =?UTF-8?q?=E2=80=94=20clear=20GHSA-h67p-54hq-rp68=20(#1338)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit js-yaml <= 4.1.1 has a quadratic-complexity DoS in merge-key handling via repeated aliases (GHSA-h67p-54hq-rp68 / CVE-2026-53550, medium). Patched in 4.2.0. js-yaml is dev-only here (direct devDependency + deduped transitive via eslint/@eslint/eslintrc), so shipped users are not exposed; the bump clears Dependabot alert #9 and patches the floor. The existing ^4.1.1 range already permitted 4.2.0 — this only refreshes the stale lockfile pin. npm audit: 0 vulnerabilities. Co-authored-by: Claude Opus 4.8 (1M context) --- package-lock.json | 18 ++++++++++++++---- package.json | 2 +- 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 56d01bce2..42e8d83f6 100644 --- a/package-lock.json +++ b/package-lock.json @@ -27,7 +27,7 @@ "eslint-plugin-no-only-tests": "^3.4.0", "fast-check": "^4.8.0", "globals": "^16.5.0", - "js-yaml": "^4.1.1", + "js-yaml": "^4.2.0", "typescript": "^6.0.3", "typescript-eslint": "^8.60.0" }, @@ -3828,10 +3828,20 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", - "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", + "version": "4.2.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", + "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], "license": "MIT", "dependencies": { "argparse": "^2.0.1" diff --git a/package.json b/package.json index 3668c5980..9337cef27 100644 --- a/package.json +++ b/package.json @@ -62,7 +62,7 @@ "eslint-plugin-no-only-tests": "^3.4.0", "fast-check": "^4.8.0", "globals": "^16.5.0", - "js-yaml": "^4.1.1", + "js-yaml": "^4.2.0", "typescript": "^6.0.3", "typescript-eslint": "^8.60.0" },