fix(deps): bump the nested js-yaml to 4.3.2 - #66
Conversation
npm audit fails on every pull request with one high-severity finding: js-yaml 4.0.0 - 4.3.1, "maxTotalMergeKeys does not limit CPU use for empty merge sources" (GHSA-2883-xcg3-v3hh), reached through node_modules/astro/node_modules/js-yaml. Only that one copy was affected. The direct dependency is already on 5.4.1 and @astrojs/internal-helpers had resolved 4.3.2; astro's nested copy was simply pinned in the lock file at 4.3.1, within a range that admits the fixed version. So this is a lock refresh, not a constraint change: package.json is untouched and no overrides entry is needed. `npm update js-yaml --package-lock-only` produces a three-line diff, one version and one resolved URL. `npm audit --audit-level=high` then reports "found 0 vulnerabilities" and exits 0, where it exited 1 before. Dependabot opened an update for this advisory on 2026-09-09 and its job failed, which is why the finding was still open. Assisted-by: claude-code:claude-opus-5 Agent-Session: https://claude.ai/code/session_01AXRGd6GWAC7TLK3wuiYeGg Agent-Host: 0493f0 Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned Files
|
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
npm auditfails on every pull request in this repository with one high-severity finding:js-yaml4.0.0 – 4.3.1, "maxTotalMergeKeys does not limit CPU use for empty merge sources" (GHSA-2883-xcg3-v3hh), reached throughnode_modules/astro/node_modules/js-yaml. It is also open as Dependabot alert 75 on the default branch.Only that one copy was affected, which is what makes the fix small. The direct dependency is already on 5.4.1, and
@astrojs/internal-helpershad resolved 4.3.2 — astro's nested copy was simply pinned in the lock file at 4.3.1, inside a range that already admits the fixed version. So this is a lock refresh, not a constraint change:package.jsonis untouched and nooverridesentry is needed. A blanket override would have been wrong here — it would have dragged the top-leveljs-yamlfrom 5.4.1 down to 4.x.npm update js-yaml --package-lock-onlyproduces the three-line diff below: oneversion, oneresolved.Verified locally:
npm audit --audit-level=highreportsfound 0 vulnerabilitiesand exits 0, where the same command exits 1 onmain.Dependabot opened an update for this advisory on 2026-09-09 and its job failed, which is why the finding was still open.
This unblocks #65, which is currently
UNSTABLEsolely because of this check.Assisted by claude-code:claude-opus-5 — Session