From 9a7a1ab2a3a01dd1d52afeb38a2a4964e2f1ef3c Mon Sep 17 00:00:00 2001 From: Tapish Khandelwal Date: Wed, 9 Sep 2026 12:01:57 +0530 Subject: [PATCH] fix(deps): raise the js-yaml floor past GHSA-2883-xcg3-v3hh `pnpm audit --audit-level high` runs inside `Verify extension`, a required check, so this advisory blocked every pull request and master itself: high js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources. vulnerable >=4.0.0 <4.3.2, patched >=4.3.2 .>eslint>@eslint/eslintrc>js-yaml (18 paths) Confirmed repository-wide rather than branch-local: master fails the same audit. `pnpm-workspace.yaml` already pinned `js-yaml: 4.3.1` exactly. That pin was the vulnerable version, so the advisory landed on a dependency this repository had already chosen to control -- the earlier fix became the next exposure precisely because it was pinned exact. Raised to `^4.3.2` rather than pinned exact again, so a future patch-level advisory in this line resolves on the next install instead of blocking every merge until someone edits this file. A caret is what a security floor wants; an exact pin is a ceiling as well. Kept in `pnpm-workspace.yaml`, which is where pnpm 11 reads overrides. A `pnpm.overrides` block in `package.json` is silently ignored -- pnpm warns and carries on, and the audit still fails, which is how the wrong location was caught here. Verified: resolved js-yaml@4.3.2 pnpm audit --audit-level high No known vulnerabilities found (exit 0) pnpm install --frozen-lockfile exit 0 lockfile diff js-yaml only; nothing else moved eslint, tsc, prettier, wxt build, package verification, and the full suite all pass, which matters because js-yaml reaches this project underneath eslint. --- pnpm-lock.yaml | 12 ++++++------ pnpm-workspace.yaml | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 68d4886a..b20cc003 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -11,7 +11,7 @@ overrides: brace-expansion@^1.1.7: 5.0.9 brace-expansion@^5.0.0: 5.0.9 esbuild: 0.28.1 - js-yaml: 4.3.1 + js-yaml: ^4.3.2 nanoid: 3.3.18 postcss: 8.5.23 shell-quote: 1.10.0 @@ -1527,8 +1527,8 @@ packages: js-tokens@9.0.1: resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==} - js-yaml@4.3.1: - resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} + js-yaml@4.3.2: + resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==} hasBin: true jsdom@29.1.1: @@ -2849,7 +2849,7 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.3.1 + js-yaml: 4.3.2 minimatch: 3.1.5(patch_hash=d94f1eb26c3903411d5d2acfd3ec0844a426c8156e7608723501a680ad20f347) strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -4199,7 +4199,7 @@ snapshots: js-tokens@9.0.1: {} - js-yaml@4.3.1: + js-yaml@4.3.2: dependencies: argparse: 2.0.1 @@ -4714,7 +4714,7 @@ snapshots: figures: 3.2.0 http-proxy-agent: 7.0.2 https-proxy-agent: 7.0.6 - js-yaml: 4.3.1 + js-yaml: 4.3.2 jsonpath-plus: 10.4.0 node-html-parser: 6.1.13 parse-github-repo-url: 1.4.1 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 472d3581..6c11ac4d 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -8,7 +8,7 @@ overrides: brace-expansion@^1.1.7: 5.0.9 brace-expansion@^5.0.0: 5.0.9 esbuild: 0.28.1 - js-yaml: 4.3.1 + js-yaml: ^4.3.2 nanoid: 3.3.18 postcss: 8.5.23 shell-quote: 1.10.0