From d07526f70616dfa1d6a98a7c5c7ce54b256d192a Mon Sep 17 00:00:00 2001 From: wfl-repo-warden Date: Fri, 14 Aug 2026 05:42:45 -0500 Subject: [PATCH] fix(deps): bump js-yaml override to 4.3.1 to clear GHSA-5p4m-2wfm-xmqj The vscode-extension npm tree pins js-yaml via a package.json override, currently at 4.3.0. Dependabot alert #69 (HIGH, GHSA-5p4m-2wfm-xmqj, "quadratic CPU consumption in !!omap resolution") affects 3.x and 4.x below 4.3.1, so the existing 4.3.0 pin is still vulnerable. Bump the override to 4.3.1 and regenerate the lockfile. js-yaml is a dev-only transitive dependency, reached through eslint 8.57.1 (@eslint/eslintrc 2.1.4) and mocha 10.8.2 (@vscode/test-cli 0.0.10); both accept 4.3.1, so it dedupes cleanly with no parent bumps. This is the last open Dependabot alert on the repository. Verification: - npm install --package-lock-only regenerates with the registry integrity hash for 4.3.1. - npm ci succeeds from a clean tree (270 packages, exit 0). - npm ls js-yaml shows 4.3.1 for all three consumers, deduped, with no unmet peer or conflicting ranges. Risk class R0 under testing.md: dependency-pin change with no behavioral surface in shipped code. No red-first test is manufactured; the existing lint/test lanes are the check. Note that CI cannot currently run to confirm that (see #695). Refs #695 --- vscode-extension/package-lock.json | 6 +++--- vscode-extension/package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/vscode-extension/package-lock.json b/vscode-extension/package-lock.json index 0042d0e2..ae4567b7 100644 --- a/vscode-extension/package-lock.json +++ b/vscode-extension/package-lock.json @@ -1907,9 +1907,9 @@ } }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "dev": true, "funding": [ { diff --git a/vscode-extension/package.json b/vscode-extension/package.json index 05db3994..fcd646c4 100644 --- a/vscode-extension/package.json +++ b/vscode-extension/package.json @@ -174,7 +174,7 @@ "@vscode/test-electron": "^2.5.2" }, "overrides": { - "js-yaml": "4.3.0", + "js-yaml": "4.3.1", "serialize-javascript": "7.0.6" } } \ No newline at end of file