chore(deps): bump js-yaml to 4.3.1 in /docs for the quadratic-omap advisory - #435
Merged
Conversation
…427) js-yaml 4.3.0 is still in the vulnerable range of the high-severity quadratic-CPU advisory: 4.3.0 fixed the merge-key chain variant, and 4.3.1 backports the same guard to `!!omap` duplicate-key resolution. Exposure here is a build-time parse of our own frontmatter, so the practical risk is limited to someone who can already commit — the bump is one line and closes a high alert on a public repo. Dependabot's own PR targeted `master`, which only fast-forwards from `dev`, so a commit there would break the next FF. The three lines are hand-edited rather than installed: `npm install js-yaml@4.3.1` promotes it to a direct dependency in package.json and strips `"libc"` platform metadata from optional entries, and `npm update` strips the same. Validated with `npm ci` (0 vulnerabilities) and a full `npm run build` (31 pages). postcss needs nothing: `dev` is at 8.5.23, which is the patched version for both open postcss advisories. Nine of the ten open Dependabot alerts describe `master`'s lockfile, not `dev`'s, and clear at the next release fast-forward.
FelixKrueger
added
the
dependencies
This was referenced Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the docs site's transitive
js-yamlfrom 4.3.0 to 4.3.1, which is still inside the range of the high-severity quadratic-CPU advisory: 4.3.0 fixed the merge-key-chain variant, and 4.3.1 backports the same guard to!!omapduplicate-key resolution. Three hand-edited lockfile lines;npm cireports 0 vulnerabilities andnpm run buildproduces all 31 pages.Dependabot's own PR (#427) targets
master, which only ever fast-forwards fromdev, so merging it there would break the next FF — same shape as #425/#430. postcss (#431) needs nothing:devis already at 8.5.23, the patched version for both open postcss advisories.AI-assisted detail
Why only one of ten alerts is real. Dependabot scans the default branch, and
masteris a release pin 70 commits behinddev. Comparing every open alert's patched version againstdev's resolved versions:devThe other nine clear on their own at the next release fast-forward.
Why hand-edited.
npm install js-yaml@4.3.1also adds the package topackage.jsonas a direct dependency and strips"libc"platform metadata from optional entries;npm updatestrips the same. Only thenode_modules/js-yamlentry's three lines change here — no requirement ranges, since 4.3.1 satisfies both the^4.3.0and^4.1.1declarations upstream packages carry.Exposure.
js-yamlis a build-time dependency of the Astro docs site, parsing our own frontmatter, so the advisory needs adversarial YAML from someone who can already commit. The reason to take it is that a high-severity alert sitting open on a public repo invites questions and the fix is one line — not that the risk is material.