From 624862e242f5d43efe49eea207464e60f1c71710 Mon Sep 17 00:00:00 2001 From: Vijit Singh Date: Fri, 21 Aug 2026 11:22:35 -0500 Subject: [PATCH] build(deps): override transitive js-yaml to 5.2.3 (fixes 2 dependabot alerts) markdownlint-cli2 0.23.0 pins js-yaml exactly at 5.2.0, which carries two DoS-class parsing advisories (dev-scope only). npm audit fix can't bump an exact pin, so this uses an npm override to the latest 5.2.x patch. Drop the override once markdownlint-cli2 ships with js-yaml >= 5.2.2. Co-Authored-By: Claude Fable 5 --- package-lock.json | 6 +++--- package.json | 3 +++ 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index b570a11..be53bcb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -431,9 +431,9 @@ } }, "node_modules/js-yaml": { - "version": "5.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.0.tgz", - "integrity": "sha512-YeLUMlvR4Ou1B119LIaM0r65JvbOBooJDc9yEu0dClb/uSC5P4FrLU8OCCz/HXWvtPoIrR0dRzABTjo1sTN9Bw==", + "version": "5.2.3", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.3.tgz", + "integrity": "sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==", "dev": true, "funding": [ { diff --git a/package.json b/package.json index 32a0ded..dc6bcb6 100644 --- a/package.json +++ b/package.json @@ -12,5 +12,8 @@ "devDependencies": { "markdownlint-cli2": "0.23.0", "prettier": "3.9.4" + }, + "overrides": { + "js-yaml": "5.2.3" } }