From a92544c96aff0ad91021eda3b24ec53d2f5227e4 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 14 Sep 2026 05:06:16 +0000 Subject: [PATCH] fix(deps): bump js-yaml override to 4.3.2 (GHSA-2883-xcg3-v3hh) js-yaml < 4.3.2 has a DoS vulnerability where maxTotalMergeKeys fails to properly bound CPU usage when a YAML document repeatedly merges empty mappings, letting a small crafted document cause prolonged CPU consumption. Bump the js-yaml override from ^4.3.1 to ^4.3.2 to pick up the fix, which counts each merge-source mapping as a budget unit. Verified full test suite (843 tests) still passes. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_016yFmmydHNhbvrmnvVtEuXZ --- package-lock.json | 6 +++--- package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index eeb5cee..6d7efe0 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1972,9 +1972,9 @@ } }, "node_modules/js-yaml": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", - "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "dev": true, "funding": [ { diff --git a/package.json b/package.json index 95729a2..98b022f 100644 --- a/package.json +++ b/package.json @@ -63,6 +63,6 @@ "form-data": "^4.0.6", "diff": "^8.0.3", "ip": "^2.0.1", - "js-yaml": "^4.3.1" + "js-yaml": "^4.3.2" } }