From bf6f67ea24e452539f1ed1525562473f5a021145 Mon Sep 17 00:00:00 2001 From: yash-atwal Date: Mon, 21 Sep 2026 18:59:10 +0530 Subject: [PATCH 1/3] fix(deps): pin js-yaml to 4.3.2 for merge-key DoS (CTO-5147) Override js-yaml to 4.3.2 (was 4.1.0). Fixes YAML merge-key chains forcing quadratic CPU consumption (GHSA-52cp-r559-cp3m), patched in the 4.x line at 4.3.0, plus the !!omap DoS fixed at 4.3.1. js-yaml is transitive dev tooling only (commitlint/husky). Co-Authored-By: Claude Opus 4.8 --- package-lock.json | 17 ++++++++++++++--- package.json | 3 +++ 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 2d7f359..05166bb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -753,9 +753,20 @@ "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==" }, "node_modules/js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", "dependencies": { "argparse": "^2.0.1" }, diff --git a/package.json b/package.json index 49b3369..3faaa07 100644 --- a/package.json +++ b/package.json @@ -6,5 +6,8 @@ "@commitlint/cli": "19.4.0", "@commitlint/config-conventional": "19.2.2", "husky": "9.1.4" + }, + "overrides": { + "js-yaml": "4.3.2" } } From 992fe293e4590d36ecfbabfec4b29432d975cd33 Mon Sep 17 00:00:00 2001 From: yash-atwal Date: Thu, 24 Sep 2026 10:58:24 +0530 Subject: [PATCH 2/3] ci(semgrep): bump semgrep image 1.166.0 -> 1.178.0 Co-Authored-By: Claude Opus 4.8 --- .github/workflows/semgrep.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index c6f6de9..aa3949d 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -18,7 +18,7 @@ jobs: name: Scan runs-on: ubuntu-20.04 container: - image: returntocorp/semgrep:1.166.0 + image: returntocorp/semgrep:1.178.0 if: (github.actor != 'dependabot[bot]') steps: - uses: actions/checkout@v4 From ee187a7229c669b62b5ba25db81b20f67f08b8e0 Mon Sep 17 00:00:00 2001 From: yash-atwal Date: Thu, 24 Sep 2026 11:00:22 +0530 Subject: [PATCH 3/3] =?UTF-8?q?fix(deps):=20drop=20duplicate=20js-yaml=20o?= =?UTF-8?q?verride=20=E2=80=94=20main=20already=20handles=20it?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The merge of main brought in its own overrides block (fast-uri + js-yaml ^4.3.1, shipped via PR #114 / CTO-5147, already deployed), leaving package.json with two overrides keys. Remove the redundant js-yaml override so a single valid overrides block remains; js-yaml still resolves to 4.3.2, fast-uri 3.1.8. Co-Authored-By: Claude Opus 4.8 --- package.json | 3 --- 1 file changed, 3 deletions(-) diff --git a/package.json b/package.json index 5070828..004bb61 100644 --- a/package.json +++ b/package.json @@ -10,8 +10,5 @@ "@commitlint/cli": "19.4.0", "@commitlint/config-conventional": "19.2.2", "husky": "9.1.4" - }, - "overrides": { - "js-yaml": "4.3.2" } }