From 7ed04e921056615674c334c48bf3c52ba17cc837 Mon Sep 17 00:00:00 2001 From: Jim Carucci <96802642+uncleJim21@users.noreply.github.com> Date: Sat, 22 Aug 2026 18:55:31 -0400 Subject: [PATCH] Patch js-yaml and brace-expansion DoS advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both are follow-on advisories published after the versions PR #136 landed on, so the previous floors no longer clear them. js-yaml 4.3.0 -> 4.3.1 (GHSA-5p4m-2wfm-xmqj, high) Quadratic CPU in !!omap resolution. The 5.x fix for CVE-2026-59870 was never backported, so 4.3.0 — the newest 4.x at the time — was still affected. !!omap is in the default schema, so a plain yaml.load() is enough; the loop is synchronous, so one request stalls the event loop for the whole process. This one reaches the runtime tree through @langchain/community, not just devDependencies. brace-expansion 1.1.17 -> 1.1.18, 2.1.3 -> 2.1.4 (GHSA-rgw5-rvv9-x895, high) DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation we picked up last time. Reachable only through build tooling (swagger-autogen codegen, archiver in dev), operating on glob patterns from our own source tree. Kept minimal: every consumer already uses a caret range, so js-yaml needed only the root bump to dedupe across @langchain/*, and brace-expansion needed only its two existing override floors raised. No new overrides, no dependency additions, and no move to js-yaml 5.x. Four packages change in the lockfile and nothing else. Verified: npm audit reports 0 critical / 0 high (3 lows remain, all the unfixable bolt11 -> secp256k1 -> elliptic chain); package.json and the lockfile stay in sync for npm ci; skills build and the zap-validator, reranker and relay-pool suites pass; native deps rebuild cleanly. Both patched versions predate the quarantine window by ~22 days, so this installs with min-release-age fully enforced and no bypass. Co-Authored-By: Claude Opus 5 (1M context) --- package-lock.json | 26 +++++++++++++------------- package.json | 6 +++--- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/package-lock.json b/package-lock.json index c207daf..18a854e 100644 --- a/package-lock.json +++ b/package-lock.json @@ -50,7 +50,7 @@ }, "devDependencies": { "archiver": "^7.0.1", - "js-yaml": "^4.3.0" + "js-yaml": "^4.3.1" } }, "node_modules/@anthropic-ai/sdk": { @@ -3388,9 +3388,9 @@ } }, "node_modules/archiver-utils/node_modules/brace-expansion": { - "version": "2.1.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.3.tgz", - "integrity": "sha512-DRdx5neNsG/QXbniLFWi2YmC/68oeOOmKz6zOjVk6ZS1ZLXgLIKqVEc6hWsmkjBbgii0SwaBTcJ5XKj5gzY/4A==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -3859,9 +3859,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "1.1.17", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.17.tgz", - "integrity": "sha512-w+aeW/mkgM4PyRMOJCgi3fOrTm5Q8QY1OSfn2TO2iuDj3ezIHqejmuxbjfPrqUkgqRew1iqkyAn0tr0ZwHD9+w==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", @@ -5552,9 +5552,9 @@ } }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github", @@ -6984,9 +6984,9 @@ } }, "node_modules/readdir-glob/node_modules/brace-expansion": { - "version": "2.1.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.3.tgz", - "integrity": "sha512-DRdx5neNsG/QXbniLFWi2YmC/68oeOOmKz6zOjVk6ZS1ZLXgLIKqVEc6hWsmkjBbgii0SwaBTcJ5XKj5gzY/4A==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index 849ee26..bddec22 100644 --- a/package.json +++ b/package.json @@ -70,13 +70,13 @@ }, "devDependencies": { "archiver": "^7.0.1", - "js-yaml": "^4.3.0" + "js-yaml": "^4.3.1" }, "overrides": { "axios": "^1.18.0", "body-parser": "^1.20.6", - "brace-expansion@1": "^1.1.16", - "brace-expansion@2": "^2.1.2", + "brace-expansion@1": "^1.1.18", + "brace-expansion@2": "^2.1.4", "form-data": "^4.0.6", "ip-address": "^10.3.1", "langsmith": "^0.6.0",