From cff2410c69a7518ff301a6027b14a135e080c522 Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Sat, 8 Aug 2026 17:48:24 +0000 Subject: [PATCH] fix(deps): bump js-yaml override to ^4.3.1 for CVE-2026-59870 js-yaml 4.3.0 is vulnerable to quadratic CPU consumption in !!omap resolution (GHSA-5p4m-2wfm-xmqj / CVE-2026-59870). The fix is backported in 4.3.1, so no major upgrade is needed; 5.x carries its own open advisory (GHSA-pm4m-ph32-ghv5, fixed 5.2.2) and would be a breaking bump. Raises the pnpm override in both site/ and crates/bashkit-js/ and refreshes both lockfiles. --- crates/bashkit-js/package.json | 2 +- crates/bashkit-js/pnpm-lock.yaml | 12 ++++++------ site/package.json | 2 +- site/pnpm-lock.yaml | 12 ++++++------ 4 files changed, 14 insertions(+), 14 deletions(-) diff --git a/crates/bashkit-js/package.json b/crates/bashkit-js/package.json index a7c58f365..199fea937 100644 --- a/crates/bashkit-js/package.json +++ b/crates/bashkit-js/package.json @@ -120,7 +120,7 @@ "overrides": { "brace-expansion": "^2.1.2", "esbuild": ">=0.28.1", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "tar": "^7.5.18" }, "onlyBuiltDependencies": [ diff --git a/crates/bashkit-js/pnpm-lock.yaml b/crates/bashkit-js/pnpm-lock.yaml index 20b55e76e..34b47c03b 100644 --- a/crates/bashkit-js/pnpm-lock.yaml +++ b/crates/bashkit-js/pnpm-lock.yaml @@ -7,7 +7,7 @@ settings: overrides: brace-expansion: ^2.1.2 esbuild: '>=0.28.1' - js-yaml: ^4.3.0 + js-yaml: ^4.3.1 tar: ^7.5.18 patchedDependencies: @@ -1375,8 +1375,8 @@ packages: js-tiktoken@1.0.21: resolution: {integrity: sha512-biOj/6M5qdgx5TKjDnFT1ymSpM5tbd3ylwDtrQvFQSu0Z7bBYko2dF+W/aUkXUPuk6IVpRxk/3Q2sHOzGlS36g==} - js-yaml@4.3.0: - resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} + js-yaml@4.3.1: + resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} hasBin: true json-with-bigint@3.5.8: @@ -1995,7 +1995,7 @@ snapshots: colorette: 2.0.20 emnapi: 1.10.0 es-toolkit: 1.46.1 - js-yaml: 4.3.0 + js-yaml: 4.3.1 obug: 2.1.1 semver: 7.8.1 typanion: 3.14.0 @@ -2823,7 +2823,7 @@ snapshots: dependencies: base64-js: 1.5.1 - js-yaml@4.3.0: + js-yaml@4.3.1: dependencies: argparse: 2.0.1 @@ -3018,7 +3018,7 @@ snapshots: supertap@3.0.1(patch_hash=fb62acff1ae3d1587268fef569b79684229eeb16c6a833a14b115a253cc00112): dependencies: indent-string: 5.0.0 - js-yaml: 4.3.0 + js-yaml: 4.3.1 serialize-error: 7.0.1 strip-ansi: 7.2.0 diff --git a/site/package.json b/site/package.json index d5ecc3a4c..8649d67df 100644 --- a/site/package.json +++ b/site/package.json @@ -37,7 +37,7 @@ "overrides": { "esbuild": ">=0.28.1", "fast-uri": "^3.1.5", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "postcss": ">=8.5.18", "sharp": ">=0.35.0 <0.36.0", "svgo": "^4.0.2", diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml index 9faecc377..bce7a7b97 100644 --- a/site/pnpm-lock.yaml +++ b/site/pnpm-lock.yaml @@ -7,7 +7,7 @@ settings: overrides: esbuild: '>=0.28.1' fast-uri: ^3.1.5 - js-yaml: ^4.3.0 + js-yaml: ^4.3.1 postcss: '>=8.5.18' sharp: '>=0.35.0 <0.36.0' svgo: ^4.0.2 @@ -1334,8 +1334,8 @@ packages: resolution: {integrity: sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==} engines: {node: '>=12'} - js-yaml@4.3.0: - resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} + js-yaml@4.3.1: + resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} hasBin: true json-schema-traverse@1.0.0: @@ -2323,7 +2323,7 @@ snapshots: dependencies: '@types/hast': 3.0.4 '@types/mdast': 4.0.4 - js-yaml: 4.3.0 + js-yaml: 4.3.1 picomatch: 4.0.4 retext-smartypants: 6.2.0 shiki: 4.1.0 @@ -3116,7 +3116,7 @@ snapshots: github-slugger: 2.0.0 html-escaper: 3.0.3 http-cache-semantics: 4.2.0 - js-yaml: 4.3.0 + js-yaml: 4.3.1 jsonc-parser: 3.3.1 magic-string: 0.30.21 magicast: 0.5.3 @@ -3519,7 +3519,7 @@ snapshots: is-plain-obj@4.1.0: {} - js-yaml@4.3.0: + js-yaml@4.3.1: dependencies: argparse: 2.0.1