From b91bbbd901b8f7c0050769671dc6d6d34bf49cd7 Mon Sep 17 00:00:00 2001 From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com> Date: Tue, 11 Aug 2026 13:29:37 +0200 Subject: [PATCH] fix(security): bump js-yaml to 4.3.1 for CVE-2026-59870 The daily security audit (issue #289) flagged the one high advisory open on main: quadratic CPU consumption in js-yaml's !!omap resolution, vulnerable range >=4.0.0 <4.3.1. The existing override said ^4.3.0 but the lock pinned 4.3.0 exactly. Raised the override floor to ^4.3.1 and refreshed the lock. Verified the RESOLVED tree, not just the declaration: the lockfile now holds a single deduped js-yaml@4.3.1 (all four transitive parents plus the gray-matter engine in src/lib/blog.ts resolve to it), and install-time audit reports 0 vulnerabilities. 441 tests green. Issue #289 closes itself on the next scheduled audit once this lands. Co-Authored-By: Claude Fable 5 --- package-lock.json | 6 +++--- package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index c58ebe7d7..89be5e066 100644 --- a/package-lock.json +++ b/package-lock.json @@ -13145,9 +13145,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github", diff --git a/package.json b/package.json index 3737b28df..9130ed56d 100644 --- a/package.json +++ b/package.json @@ -183,7 +183,7 @@ "ajv": "^6.14.0", "minimatch": "^10.2.1", "nodemailer": "^9.0.1", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "basic-ftp": ">=5.3.0", "postcss": "^8.5.26", "esbuild": "0.28.1",