Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vulnerabilities by dependabot[bot] · Pull Request #943 · actions/labeler

dependabot · 2026-06-19T15:23:31Z

Summary

Bumps js-yaml from 4.1.1 to 4.2.0, applies npm audit fix, and adds a undici override to achieve 0 known vulnerabilities.

Changes

js-yaml `4.1.1` → `4.2.0`

undici override

Pinned undici to 6.27.0 via overrides in package.json
Removes vulnerable undici@5.29.0 and consolidates to a single secure version
Removes obsolete @fastify/busboy dependency (no longer needed by undici@6)

npm audit fix

Applied npm audit fix — bumped transitive dev dependencies (@babel/*, browserslist, brace-expansion, etc.) to their latest safe versions
Removed obsolete license files for @fastify/busboy and old undici@6.25.0; added updated undici license file

Security

✅ npm audit reports 0 vulnerabilities after these changes.

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.2.0. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

… and bump js-yaml to 4.2.0

…i license file

…-lock.json

…v6.1.0 ➔ v6.2.0) (#1478) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://github.com/actions/labeler](https://github.com/actions/labeler) | action | minor | `v6.1.0` → `v6.2.0` | --- ### Release Notes <details> <summary>actions/labeler (https://github.com/actions/labeler)</summary> ### [`v6.2.0`](https://github.com/actions/labeler/releases/tag/v6.2.0) [Compare Source](actions/labeler@v6.1.0...v6.2.0) #### What's Changed ##### Bug Fix - Improve PR number validation and warning messages in input handling by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#939](actions/labeler#939) ##### Dependency Updates - Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override by [@dependabot](https://github.com/dependabot) in [#943](actions/labeler#943) - Bump [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/eslint-plugin) from 8.59.1 to 8.61.1 by [@dependabot](https://github.com/dependabot) in [#942](actions/labeler#942) **Full Changelog**: <actions/labeler@v6.1.0...v6.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1478

…v6.1.0 → v6.2.0) (#234) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://github.com/actions/labeler](https://github.com/actions/labeler) | action | minor | `v6.1.0` → `v6.2.0` | --- ### Release Notes <details> <summary>actions/labeler (https://github.com/actions/labeler)</summary> ### [`v6.2.0`](https://github.com/actions/labeler/releases/tag/v6.2.0) [Compare Source](actions/labeler@v6.1.0...v6.2.0) #### What's Changed ##### Bug Fix - Improve PR number validation and warning messages in input handling by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#939](actions/labeler#939) ##### Dependency Updates - Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override by [@dependabot](https://github.com/dependabot) in [#943](actions/labeler#943) - Bump [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/eslint-plugin) from 8.59.1 to 8.61.1 by [@dependabot](https://github.com/dependabot) in [#942](actions/labeler#942) **Full Changelog**: <actions/labeler@v6.1.0...v6.2.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://forgejo.hayden.moe/hayden/phoebe/pulls/234

…v6.1.0 ➔ v6.2.0) (#490) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://github.com/actions/labeler](https://github.com/actions/labeler) | action | minor | `v6.1.0` → `v6.2.0` | --- ### Release Notes <details> <summary>actions/labeler (https://github.com/actions/labeler)</summary> ### [`v6.2.0`](https://github.com/actions/labeler/releases/tag/v6.2.0) [Compare Source](actions/labeler@v6.1.0...v6.2.0) #### What's Changed ##### Bug Fix - Improve PR number validation and warning messages in input handling by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#939](actions/labeler#939) ##### Dependency Updates - Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override by [@dependabot](https://github.com/dependabot) in [#943](actions/labeler#943) - Bump [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/eslint-plugin) from 8.59.1 to 8.61.1 by [@dependabot](https://github.com/dependabot) in [#942](actions/labeler#942) **Full Changelog**: <actions/labeler@v6.1.0...v6.2.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.greyrock.io/greyrock-labs/home-ops/pulls/490

…386) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/labeler](https://github.com/actions/labeler) | action | major | `v6.1.0` → `v7.0.0` | --- ### Release Notes <details> <summary>actions/labeler (actions/labeler)</summary> ### [`v7.0.0`](https://github.com/actions/labeler/releases/tag/v7.0.0) [Compare Source](actions/labeler@v6.2.0...v7.0.0) #### What's Changed ##### Enhancements: - Migrate to ESM and update dependencies by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#949](actions/labeler#949) **Full Changelog**: <actions/labeler@v6...v7.0.0> ### [`v6.2.0`](https://github.com/actions/labeler/releases/tag/v6.2.0) [Compare Source](actions/labeler@v6.1.0...v6.2.0) #### What's Changed ##### Bug Fix - Improve PR number validation and warning messages in input handling by [@chiranjib-swain](https://github.com/chiranjib-swain) in [#939](actions/labeler#939) ##### Dependency Updates - Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override by [@dependabot](https://github.com/dependabot) in [#943](actions/labeler#943) - Bump [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/eslint-plugin) from 8.59.1 to 8.61.1 by [@dependabot](https://github.com/dependabot) in [#942](actions/labeler#942) **Full Changelog**: <actions/labeler@v6.1.0...v6.2.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Warsaw) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.ajgon.casa/deedee/mark13/pulls/386

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 19, 2026

dependabot Bot requested a review from a team as a code owner June 19, 2026 15:23

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 19, 2026

Bump js-yaml to version 4.2.0

0b5b84f

v-chiranjib-swain mentioned this pull request Jun 22, 2026

Bump js-yaml from 4.1.1 to 4.2.0 #916

Closed

v-priya-kinthali previously approved these changes Jun 22, 2026

View reviewed changes

v-chiranjib-swain previously approved these changes Jun 22, 2026

View reviewed changes

chore: update package.json and package-lock.json with undici override…

e7c2e4b

… and bump js-yaml to 4.2.0

v-chiranjib-swain dismissed stale reviews from v-priya-kinthali and themself via e7c2e4b July 1, 2026 04:22

v-chiranjib-swain added 2 commits July 1, 2026 09:54

chore: remove obsolete license files for busboy and undici, add undic…

d3f3320

…i license file

chore: update version to 6.2.0 in package.json and regenerate package…

c84d967

…-lock.json

v-chiranjib-swain changed the title ~~Bump js-yaml from 4.1.1 to 4.2.0~~ Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vulnerabilities Jul 2, 2026

v-priya-kinthali approved these changes Jul 3, 2026

View reviewed changes

v-HarithaVattikuti approved these changes Jul 6, 2026

View reviewed changes

v-HarithaVattikuti merged commit 53affe8 into main Jul 6, 2026
7 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/js-yaml-4.2.0 branch July 6, 2026 16:54

Navigation Menu

Uh oh!

Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vulnerabilities - #943

Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vulnerabilities#943
v-HarithaVattikuti merged 5 commits into
mainfrom
dependabot/npm_and_yarn/js-yaml-4.2.0

dependabot Bot commented on behalf of github Jun 19, 2026 •

edited by v-chiranjib-swain

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 19, 2026 • edited by v-chiranjib-swain Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

js-yaml 4.1.1 → 4.2.0

undici override

npm audit fix

Security

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dependabot Bot commented on behalf of github Jun 19, 2026 •

edited by v-chiranjib-swain

Loading

js-yaml `4.1.1` → `4.2.0`