From dda0c61c0b4f2aaea622b8c8017a68c491575ee7 Mon Sep 17 00:00:00 2001 From: alexander-neuschl-tu-dresden-de Date: Thu, 20 Aug 2026 15:35:25 +0200 Subject: [PATCH 1/2] Upgrade js-yaml to 4.3.1 to resolve high vulnerability The vulnerable versions of js-yaml were expanded to include 4.3.0 which we recently updated to: https://github.com/advisories/GHSA-5p4m-2wfm-xmqj This was fixed by a backported update which resulted in the new version 4.3.1 https://github.com/nodeca/js-yaml/commit/c3cc4b0bb9ddb9af2dd9b61e0d56f5ce7983cd4a --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 86eaed72..3449d48f 100644 --- a/package.json +++ b/package.json @@ -77,7 +77,7 @@ "cm6-theme-basic-light": "^0.2.0", "codemirror": "^6.0.1", "downshift": "^7.6.0", - "js-yaml": "4.3.0", + "js-yaml": "4.3.1", "lexical": "^0.48.0", "mdast-util-directive": "^3.0.0", "mdast-util-from-markdown": "^2.0.0", From b607c8ce2d88ce582ea933615dd8d67bb6dcbb8a Mon Sep 17 00:00:00 2001 From: Petyo Ivanov Date: Fri, 21 Aug 2026 09:58:37 +0300 Subject: [PATCH 2/2] Update package-lock.json for js-yaml 4.3.1 --- package-lock.json | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 876a1a12..05c81620 100644 --- a/package-lock.json +++ b/package-lock.json @@ -40,7 +40,7 @@ "cm6-theme-basic-light": "^0.2.0", "codemirror": "^6.0.1", "downshift": "^7.6.0", - "js-yaml": "4.3.0", + "js-yaml": "4.3.1", "lexical": "^0.48.0", "mdast-util-directive": "^3.0.0", "mdast-util-from-markdown": "^2.0.0", @@ -13224,9 +13224,9 @@ "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==" }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github", @@ -13237,7 +13237,6 @@ "url": "https://github.com/sponsors/nodeca" } ], - "license": "MIT", "dependencies": { "argparse": "^2.0.1" },