Skip to content

Bump js-yaml to a patched version#6856

Merged
shawnHartsell merged 1 commit into
mainfrom
security/bump-deps-vuln-218392
Jul 24, 2026
Merged

Bump js-yaml to a patched version#6856
shawnHartsell merged 1 commit into
mainfrom
security/bump-deps-vuln-218392

Conversation

@shawnHartsell

Copy link
Copy Markdown
Contributor

Remediates the outstanding Dependabot finding for rest-api-description.

js-yaml is a transitive dependency (pulled in via eslint), so it's pinned via an npm override — the same mechanism this repo already uses for lodash. The update stays within the current major version line.

Dependency From To Severity Vulnerability Advisory
js-yaml 4.2.0 4.3.0 High YAML merge-key chains can force quadratic CPU consumption (CVE-2026-59869) GHSA-52cp-r559-cp3m

package-lock.json was regenerated with npm install --package-lock-only, so the diff is limited to the single resolution plus the new override entry. No changes to any OpenAPI description files.

Closes https://github.com/github/vuln-mgmt/issues/218392

Adds an npm override pinning the transitive js-yaml dependency to its
patched version:

- js-yaml 4.2.0 -> 4.3.0 (GHSA-52cp-r559-cp3m, CVE-2026-59869)

Stays within the current major version line.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 578b6525-9314-4451-8a03-97df3e5f04cd
Copilot AI review requested due to automatic review settings July 24, 2026 19:03

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the transitive js-yaml dependency to the patched 4.3.0 release, addressing CVE-2026-59869.

Changes:

  • Adds an npm override for js-yaml 4.3.0 or later within major version 4.
  • Regenerates the lockfile with the patched resolution and integrity metadata.
Show a summary per file
File Description
package.json Adds the js-yaml override.
package-lock.json Locks transitive consumers to js-yaml 4.3.0.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 1/2 changed files
  • Comments generated: 0
  • Review effort level: Medium

@shawnHartsell
shawnHartsell merged commit 16bc535 into main Jul 24, 2026
8 checks passed
@shawnHartsell
shawnHartsell deleted the security/bump-deps-vuln-218392 branch July 24, 2026 20:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants