From ac7a88f32b727998e0385cd242e4ff7a12674927 Mon Sep 17 00:00:00 2001 From: Alyar <> Date: Fri, 24 Jul 2026 14:33:07 +0400 Subject: [PATCH] chore(security): tighten js-yaml override to >=4.3.0 (GHSA-52cp-r559-cp3m) The lockfile already resolves js-yaml to the patched 4.3.0, but the override range (<=4.1.1) did not cover the vulnerable 4.2.0. Tighten it to <4.3.0 -> ^4.3.0 so the fix cannot regress on re-resolve. GHSA-52cp-r559-cp3m / CVE-2026-59869 (high) is a quadratic-CPU DoS via YAML merge-key chains. js-yaml is a transitive dev/build dependency only and is not shipped in any published package. Co-Authored-By: Claude Opus 4.8 (1M context) --- pnpm-lock.yaml | 2 +- pnpm-workspace.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 0d0be5b474cf..cdcb100cfdda 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -191,7 +191,7 @@ overrides: http-proxy-middleware@>=0.16.0 <3.0.7: ^3.0.7 immutable@>=4.0.0-rc.1 <4.3.8: ^4.3.8 ip-address@<=10.1.0: '>=10.1.1' - js-yaml@<=4.1.1: ^4.2.0 + js-yaml@<4.3.0: ^4.3.0 json5@<1.0.2: ^2.2.3 lodash@<4.18.1: 4.18.1 micromatch@<4.0.8: ^4.0.8 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index f65d72aa0586..464e3f62c8c7 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -33,7 +33,7 @@ overrides: "http-proxy-middleware@>=0.16.0 <3.0.7": ^3.0.7 "immutable@>=4.0.0-rc.1 <4.3.8": ^4.3.8 "ip-address@<=10.1.0": ">=10.1.1" - "js-yaml@<=4.1.1": ^4.2.0 + "js-yaml@<4.3.0": ^4.3.0 "json5@<1.0.2": ^2.2.3 "lodash@<4.18.1": 4.18.1 "micromatch@<4.0.8": ^4.0.8