Skip to content

Update "js-yaml" dependency to 4.x #1801

Closed
Closed
Update "js-yaml" dependency to 4.x#1801
Assignees
mhassan1
Labels
Type: Securitydependency

Description

@cluick
cluick
opened on Jun 16, 2026

Hi folks!
We have problems with Grunt due to a security issue in js-yaml 3.14.2: GHSA-h67p-54hq-rp68
As safeLoad is no longer present in js-yaml 4.2.0, we cannot simply configure an override for that package.
Are there any plans to update this dependency?
Best,
Christof

Activity

  1. cluick commented on Jun 16, 2026

    @cluick
    cluick
    on Jun 16, 2026
    Author

    I've opened a PR #1802 with a proposed fix.

  2. mhassan1 commented on Jul 9, 2026

    @mhassan1
    mhassan1
    on Jul 9, 2026
    Contributor

    Related: #1803

  3. Krinkle
    assigned
    mhassan1
    on Jul 23, 2026
  4. Krinkle
    added
    dependency
    Type: Security
    on Jul 23, 2026
  5. Krinkle
    closed this as completedon Jul 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Type: Securitydependency

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions