From cc143eed7f2573e9bbc0dc77e1ea17f03fadf270 Mon Sep 17 00:00:00 2001 From: Sonu Kapoor Date: Tue, 8 Sep 2026 20:50:43 -0400 Subject: [PATCH] fix: upgrade js-yaml to 3.15.2 to resolve GHSA-2883-xcg3-v3hh A new advisory published 2026-09-08 flags js-yaml below 3.15.2 for unbounded CPU use when maxTotalMergeKeys sees empty merge sources. The finding is dev-only and transitive, reached through jest via @istanbuljs/load-nyc-config@1.1.0, which already permits 3.15.2 inside its existing range. Applied with cve-lite --fix as a within-range refresh, so package.json is unchanged and no baseline entry is needed. --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 734fa27f..1bbaab7b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3890,9 +3890,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "3.15.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", - "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", + "version": "3.15.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz", + "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==", "dev": true, "license": "MIT", "dependencies": {