Repository navigation
fix: bump js-yaml resolutions to 4.3.0 for CVE-2026-59869 - #656
Merged
jonburdo merged 1 commit intoSep 16, 2026
Conversation
|
/ok-to-test |
7 of 31 tasks
NeriCarcasci
force-pushed
the
fix/js-yaml-4.3-resolutions-rhoai-3.3
branch
from
August 12, 2026 09:55
415ed5d to
7822fa7
Compare
2 tasks done
NeriCarcasci
force-pushed
the
fix/js-yaml-4.3-resolutions-rhoai-3.3
branch
from
September 14, 2026 08:17
7822fa7 to
687a44a
Compare
This was referenced Sep 16, 2026
Remove leftover vulnerable js-yaml@4.2.0 forced by yarn resolutions for build tooling so the lockfile/SBOM only carries the fixed 4.3.0 already used by the UI bundle. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Neri Carcasci <nericarcasci@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>
NeriCarcasci
force-pushed
the
fix/js-yaml-4.3-resolutions-rhoai-3.3
branch
from
September 16, 2026 15:08
687a44a to
f11fbf7
Compare
jonburdo
approved these changes
Sep 16, 2026
jonburdo
merged commit Sep 16, 2026
dd73d74
into
red-hat-data-services:rhoai-3.3
42 of 43 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issues/PRs
Relates to CVE-2026-59869 (
js-yamlDoS via crafted YAML documents)What changes are proposed in this pull request?
Bump the UI
js-yamldependency and yarnresolutionsfrom4.2.0to4.3.0.The MLflow UI already resolved its direct
js-yaml@^4.2.0dependency to fixed4.3.0. Vulnerablejs-yaml@4.2.0remained in the lockfile only because yarn resolutions forced older tooling ranges (^3.13.1,^3.14.0,^4.0.0,^4.1.0) onto4.2.0for packages such as eslint/knip/svgo. Those tooling consumers are not part of the shipped webpack UI bundle, but scanners still flag the lockfile entry.This change:
js-yaml@^4.3.0npm:4.3.0(including^4.2.0)js-yaml@4.2.0fromyarn.lockso only the fixed version remainsHow is this PR tested?
Existing unit/integration tests
New unit/integration tests
Manual tests
yarn installdropsjs-yaml@4.2.0; lockfile only containsjs-yaml@4.3.0yarn lintpassedyarn knippassedDoes this PR require documentation update?
Does this PR require updating the MLflow Skills repository?
Release Notes
Is this a user-facing change?
What component(s), interfaces, languages, and integrations does this PR affect?
Components
area/tracking: Tracking Service, tracking client APIs, autologgingarea/models: MLmodel format, model serialization/deserialization, flavorsarea/model-registry: Model Registry service, APIs, and the fluent client calls for Model Registryarea/scoring: MLflow Model server, model deployment tools, Spark UDFsarea/evaluation: MLflow model evaluation features, evaluation metrics, and evaluation workflowsarea/gateway: MLflow AI Gateway client APIs, server, and third-party integrationsarea/prompts: MLflow prompt engineering features, prompt templates, and prompt managementarea/tracing: MLflow Tracing features, tracing APIs, and LLM tracing functionalityarea/projects: MLproject format, project running backendsarea/uiux: Front-end, user experience, plotting, JavaScript, JavaScript dev serverarea/build: Build and test infrastructure for MLflowarea/docs: MLflow documentation pagesHow should the PR be classified in the release notes? Choose one:
rn/none- No description will be included. The PR will be mentioned only by the PR number in the "Small Bugfixes and Documentation Updates" sectionrn/breaking-change- The PR will be mentioned in the "Breaking Changes" sectionrn/feature- A new user-facing feature worth mentioning in the release notesrn/bug-fix- A user-facing bug fix worth mentioning in the release notesrn/documentation- A user-facing documentation change worth mentioning in the release notesIs this PR a critical bugfix or security fix that should go into the next patch release?
What is a minor/patch release?
Minor releases are expected to contain larger changes, such as new features and improvements. Non-critical bug fixes and doc updates can be included as well. By default, your PR should target the next minor release.
Patch releases are typically only performed when there has been a major regression or bug in the latest release. For the sake of stability, your PR should not be included in a patch release unless it is a critical fix, or if the risk level of your PR is exceedingly low.
Made with Cursor