From b7a131eb156106e0eba1080ce7bb58b688fc60c9 Mon Sep 17 00:00:00 2001 From: Steve Ackley Date: Fri, 14 Aug 2026 23:33:15 -0400 Subject: [PATCH] fix(deps): patch js-yaml and kotlin-gradle-plugin advisories js-yaml 4.3.0 -> 4.3.1 in site/package-lock.json fixes GHSA-5p4m-2wfm-xmqj (quadratic CPU in !!omap resolution, high severity). kotlin-gradle-plugin 2.4.10 -> 2.4.20-RC fixes GHSA-r937-wjx7-w2jp (unsafe deserialization in build cache metadata, medium severity, CVE-2026-53914). No stable 2.4.20 exists yet upstream (Beta1/Beta2/RC only) - RC is the newest available and still satisfies the patched range (>= 2.4.20-Beta1). Verified clean via testDebugUnitTest, lint, detekt, and assembleRelease. --- gradle/libs.versions.toml | 2 +- site/package-lock.json | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index fd0f068..eda184d 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -1,6 +1,6 @@ [versions] agp = "9.3.1" -kotlin = "2.4.10" +kotlin = "2.4.20-RC" compose-bom = "2026.06.01" androidx-core-ktx = "1.19.0" androidx-lifecycle = "2.11.0" diff --git a/site/package-lock.json b/site/package-lock.json index c375019..b53cb9e 100644 --- a/site/package-lock.json +++ b/site/package-lock.json @@ -3711,9 +3711,9 @@ } }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github",