Chore(deps): js-yaml 3.15.2 / 4.3.2 and svgo 3.3.5 (today's advisories) - #753
Merged
Merged
Conversation
Lockfile-only. Three advisories published today turn the production audit red: js-yaml GHSA-2883-xcg3-v3hh (3.15.1 -> 3.15.2 for gray-matter's copy, 4.3.1 -> 4.3.2 for the root copy) and svgo GHSA-w27v-7q3p-w38r / GHSA-4vpr-x523-8j87 (3.3.4 -> 3.3.5, reached through node-tikzjax in the desktop app). Every move stays inside the dependents' existing ranges, so package.json is untouched. hono's moderate advisories remain, below the gate.
adibhanna
added a commit
to ZenNotes/zennotesandroid
that referenced
this pull request
Sep 8, 2026
The pin moves from the v2.46.0 tag commit to the upstream main commit that bumps js-yaml and svgo in its lockfile (ZenNotes/zennotes#753), so CI's audit of the upstream checkout passes again. The app core stays 2.46.0: the two commits past the tag are packaging metadata and that lockfile. No shell changes.
adibhanna
added a commit
to ZenNotes/zennotesios
that referenced
this pull request
Sep 8, 2026
The pin moves from 3301a29 (one past v2.45.0) to the upstream main commit that bumps js-yaml and svgo in its lockfile (ZenNotes/zennotes#753), so CI's audit of the upstream checkout passes again. That takes main's app core to 2.46.0 plus the packaging-metadata and lockfile commits behind it. No shell changes: the 2.45 -> 2.46 bridge-contract diff is optional fields only (kanbanFolderRoot, comment author/parentId, supportsCustomTemplates, the 'templates' change kind), and the desktop vault.ts change moves comment normalization out of a file this shell keeps its own copy of. release/1.9.8 still pins the v2.46.0 tag commit and needs the same move before its PR can go green.
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lockfile-only bump for three advisories published today that turn the production audit red, here and in the phone shells, which audit this checkout at their pin.
Every move stays inside the dependents' existing ranges, so package.json is untouched. hono's moderate advisories remain, below the gate.
Verification
npm audit --omit=dev --audit-level=highexits 0 (one moderate left).npm run typecheck: 7/7 tasks.The iOS and Android shells re-pin to the squash commit once this lands.