Why
npm audit --audit-level=high reports two high-severity findings, and this time they are real rather than an unreachable advisory service (#80):
high js-yaml — maxTotalMergeKeys does not limit CPU use for empty merge sources
GHSA-2883-xcg3-v3hh
reached through @redocly/openapi-core 1.34.19
which openapi-typescript 7.13.0 depends on
The advisory was published after the last green run: nothing in the repository changed. It surfaced on PR #93, which touches no dependency.
What it is worth
A development dependency only. openapi-typescript generates the frontend's types from our own openapi.json and never reaches a merchant's installation. The attack is a denial of service through crafted YAML, and the only YAML this toolchain reads is the contract this repository produces.
Stated so the fix is not mistaken for an emergency — and fixed anyway, because a gate that stays red teaches everyone to ignore it.
Build
npm audit fix is enough, and its blast radius was measured before opening this:
- 2 packages changed, in
package-lock.json only. package.json is untouched, so no declared range moves.
npm audit --audit-level=high reports 0 vulnerabilities afterwards.- 14 lines added, 14 removed in the lockfile.
Validation
just frontend-check, just frontend-test, just frontend-build — the generated types must still match, so just api-check matters most here.npm audit --audit-level=high exits 0.
Out of scope
Any other dependency update. This is one advisory, and a lockfile bump that carries unrelated versions along is a lockfile bump nobody can review.
Why
npm audit --audit-level=highreports two high-severity findings, and this time they are real rather than an unreachable advisory service (#80):The advisory was published after the last green run: nothing in the repository changed. It surfaced on PR #93, which touches no dependency.
What it is worth
A development dependency only.
openapi-typescriptgenerates the frontend's types from our ownopenapi.jsonand never reaches a merchant's installation. The attack is a denial of service through crafted YAML, and the only YAML this toolchain reads is the contract this repository produces.Stated so the fix is not mistaken for an emergency — and fixed anyway, because a gate that stays red teaches everyone to ignore it.
Build
npm audit fixis enough, and its blast radius was measured before opening this:package-lock.jsononly.package.jsonis untouched, so no declared range moves.npm audit --audit-level=highreports 0 vulnerabilities afterwards.Validation
just frontend-check,just frontend-test,just frontend-build— the generated types must still match, sojust api-checkmatters most here.npm audit --audit-level=highexits 0.Out of scope
Any other dependency update. This is one advisory, and a lockfile bump that carries unrelated versions along is a lockfile bump nobody can review.