From 0b3cea2b111f0c612afa9cfbe05729828ae47384 Mon Sep 17 00:00:00 2001 From: Felix Krueger Date: Fri, 14 Aug 2026 21:10:07 +0200 Subject: [PATCH] chore(deps): bump js-yaml to 4.3.1 in /docs for GHSA quadratic-omap (#427) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit js-yaml 4.3.0 is still in the vulnerable range of the high-severity quadratic-CPU advisory: 4.3.0 fixed the merge-key chain variant, and 4.3.1 backports the same guard to `!!omap` duplicate-key resolution. Exposure here is a build-time parse of our own frontmatter, so the practical risk is limited to someone who can already commit — the bump is one line and closes a high alert on a public repo. Dependabot's own PR targeted `master`, which only fast-forwards from `dev`, so a commit there would break the next FF. The three lines are hand-edited rather than installed: `npm install js-yaml@4.3.1` promotes it to a direct dependency in package.json and strips `"libc"` platform metadata from optional entries, and `npm update` strips the same. Validated with `npm ci` (0 vulnerabilities) and a full `npm run build` (31 pages). postcss needs nothing: `dev` is at 8.5.23, which is the patched version for both open postcss advisories. Nine of the ten open Dependabot alerts describe `master`'s lockfile, not `dev`'s, and clear at the next release fast-forward. --- docs/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/package-lock.json b/docs/package-lock.json index b095e70..0ec7a01 100644 --- a/docs/package-lock.json +++ b/docs/package-lock.json @@ -4158,9 +4158,9 @@ } }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github",