From bd2b41e5de70f25d1adbb6a4f5770c9a95960a53 Mon Sep 17 00:00:00 2001 From: Sebastien Tardif Date: Wed, 16 Sep 2026 11:00:37 -0700 Subject: [PATCH] chore(deps): pin js-yaml 4.x to 4.3.2 for GHSA-2883-xcg3-v3hh Keep the 5.x copy used by vscode-extension-tester on its own line. Unblocks the required npm audit check on Dependabot PRs. Signed-off-by: Sebastien Tardif --- package-lock.json | 6 +++--- package.json | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 7029129..f796490 100644 --- a/package-lock.json +++ b/package-lock.json @@ -4817,9 +4817,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", - "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "dev": true, "funding": [ { diff --git a/package.json b/package.json index 00803d3..bdc066f 100644 --- a/package.json +++ b/package.json @@ -262,6 +262,7 @@ "overrides": { "brace-expansion": "5.0.9", "fast-uri": "3.1.7", + "js-yaml@4": "4.3.2", "qs": "6.16.0", "mocha": { "diff": "^8.0.3",