Skip to content

v2.9.2 Patch `js-yaml` Vulnerability

Choose a tag to compare

View all tags
@paudang paudang released this 30 Jul 01:27
· 6 commits to main since this release
v2.9.2
c5b25f0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Patch js-yaml Vulnerability (GHSA-52cp-r559-cp3m):
    • Updated js-yaml override in package.json to ^4.3.0 to eliminate quadratic CPU consumption vulnerability without forcing any downgrade of jest or other core dependencies.
    • Mitigated additional transitively flagged advisories for postcss (^8.5.24) and brace-expansion (^5.0.8), maintaining a pristine 0-vulnerability baseline across npm audit.

Fixed

  • TypeScript Queue & Worker Type Safety:
    • Removed stale // @ts-expect-error directives in emailQueue.ts.ejs and emailWorker.ts.ejs to resolve error TS2578: Unused '@ts-expect-error' directive during tsc compilation.
    • Resolved TS2322: Type 'BullMQAdapter' is not assignable to type 'BaseAdapter' in queueBoard.ts.ejs using type-safe double casting (Parameters<typeof createBullBoard>[0]['queues'][number]) without using any or @ts-expect-error.
    • Refactored baseConsumer.spec.ts.ejs to use (BaseConsumer as unknown as new () => void) for strict type safety.
Assets 2
Loading