From 38ce75e415758aba47d3986332644d1fceba8ae8 Mon Sep 17 00:00:00 2001 From: Zahin Mohammad Date: Thu, 6 Aug 2026 22:18:26 -0400 Subject: [PATCH] fix(root): bump js-yaml 4.3.0 -> 4.3.1 to clear HIGH osv finding js-yaml@4.3.0 is affected by GHSA-5p4m-2wfm-xmqj (CVSS 7.5, HIGH): quadratic CPU consumption in !!omap resolution, a DoS vector. This is the only advisory group at/above CVSS 7.0, so it fails the release severity gate (.github/workflows/publish.yml -> osv-severity-gate). The root resolutions/overrides already pinned js-yaml to 4.3.0, which is itself vulnerable. Bump both pins to the patched v4 release 4.3.1 (same v4 API) and update the single lockfile block. js-yaml is dev-tooling only here (lerna, eslint, depcheck, cosmiconfig, mocha, nyc). Validated: yarn install --frozen-lockfile passes; yarn check-deps passes; yarn why js-yaml resolves to 4.3.1; no js-yaml < 4.3.1 remains in yarn.lock. TICKET: WCN-2047 Co-Authored-By: Claude Opus 4.8 --- package.json | 4 ++-- yarn.lock | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index 5ea078b04b..286bf41339 100644 --- a/package.json +++ b/package.json @@ -151,7 +151,7 @@ "sigstore": "4.1.1", "**/bn.js": "5.2.3", "uuid": "11.1.1", - "js-yaml": "4.3.0", + "js-yaml": "4.3.1", "ip-address": "10.4.0", "socket.io-parser": "4.2.7" }, @@ -216,7 +216,7 @@ "sigstore": "4.1.1", "bn.js": "5.2.3", "uuid": "11.1.1", - "js-yaml": "4.3.0", + "js-yaml": "4.3.1", "ip-address": "10.4.0", "socket.io-parser": "4.2.7", "cliui": { diff --git a/yarn.lock b/yarn.lock index fc843be62e..c7b425b304 100644 --- a/yarn.lock +++ b/yarn.lock @@ -13883,10 +13883,10 @@ js-xdr@^1.1.3: lodash "^4.17.5" long "^2.2.3" -js-yaml@4.1.0, js-yaml@4.3.0, js-yaml@^3.13.1, js-yaml@^3.14.1, js-yaml@^4.1.0: - version "4.3.0" - resolved "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz#d1900572a7f7cf0b5f540c83673e60bad3436592" - integrity sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q== +js-yaml@4.1.0, js-yaml@4.3.1, js-yaml@^3.13.1, js-yaml@^3.14.1, js-yaml@^4.1.0: + version "4.3.1" + resolved "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz#01216c001d67f48e2cd560d708c7af21090a3848" + integrity sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ== dependencies: argparse "^2.0.1"