build(deps): override transitive js-yaml to 5.2.3 (fixes 2 dependabot alerts) - #34
Merged
Merged
Conversation
… alerts) markdownlint-cli2 0.23.0 pins js-yaml exactly at 5.2.0, which carries two DoS-class parsing advisories (dev-scope only). npm audit fix can't bump an exact pin, so this uses an npm override to the latest 5.2.x patch. Drop the override once markdownlint-cli2 ships with js-yaml >= 5.2.2. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves both open Dependabot alerts (1 high, 1 moderate — DoS-class parsing advisories in js-yaml, dev-scope only). markdownlint-cli2 0.23.0 pins js-yaml exactly at 5.2.0, so
npm audit fixcan't bump it; this adds an npmoverridesentry to 5.2.3, the latest 5.2.x patch.Verified:
npm auditreports 0 vulnerabilities, andnpm run lint(the js-yaml consumer) passes.Drop the override once markdownlint-cli2 ships with js-yaml ≥ 5.2.2.
Ponytail review: lean already — 3-line override, minimal fix for an exact-pinned transitive dep.
🤖 Generated with Claude Code