From dae60a59bb1da813f4bc73a7f6c01114e0fd8cfe Mon Sep 17 00:00:00 2001 From: michalharakal Date: Sun, 20 Sep 2026 15:18:14 +0200 Subject: [PATCH] security: pin js-yaml to 4.3.2 GHSA-2883-xcg3-v3hh (high): maxTotalMergeKeys does not limit CPU use for empty merge sources, fixed in 4.3.2. JS build/test tooling only; lockfile regenerated with kotlinUpgradeYarnLock, verifyNpmPins green. --- gradle/libs.versions.toml | 2 +- kotlin-js-store/yarn.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 848c957b..300050ff 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -48,7 +48,7 @@ kotest = "6.2.5" # Check which graph holds a package before deciding: # grep -c '^webpack@' kotlin-js-store/yarn.lock kotlin-js-store/wasm/yarn.lock npm-ws = "8.21.1" # GHSA-96hv-2xvq-fx4p -npm-js-yaml = "4.3.1" # GHSA-5p4m-2wfm-xmqj +npm-js-yaml = "4.3.2" # GHSA-5p4m-2wfm-xmqj, GHSA-2883-xcg3-v3hh npm-socketio-parser = "4.2.7" # GHSA-2m8v-j782-fhvr npm-fast-uri = "3.1.6" # GHSA-7p8r-x3mc-p8w7, GHSA-v2hh-gcrm-f6hx, GHSA-jqff-g426-hqxp, # GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-5jgf-p345-68v8 diff --git a/kotlin-js-store/yarn.lock b/kotlin-js-store/yarn.lock index 0d502271..fb3194b2 100644 --- a/kotlin-js-store/yarn.lock +++ b/kotlin-js-store/yarn.lock @@ -1155,10 +1155,10 @@ jest-worker@^27.4.5: merge-stream "^2.0.0" supports-color "^8.0.0" -js-yaml@4.3.1, js-yaml@^4.1.0: - version "4.3.1" - resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.1.tgz#01216c001d67f48e2cd560d708c7af21090a3848" - integrity sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ== +js-yaml@4.3.2, js-yaml@^4.1.0: + version "4.3.2" + resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.2.tgz#8e44fb14a2643c59726bb15787b5f1512cb3d3fb" + integrity sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA== dependencies: argparse "^2.0.1"