deps: bump js-yaml to ^5.2.2 to fix DoS (fixes #4399) - #4402
Open
dhanji4U wants to merge 1 commit into
Open
Conversation
dhanji4U
requested review from
cixzhang,
ejhammond and
imdreamrunner
as code owners
July 26, 2026 14:29
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Hi @dhanji4U! Thank you for your pull request and welcome to our community. Action RequiredIn order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you. ProcessIn order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA. Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks! |
github-actions
Bot
added
community
|
Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Meta Open Source project. Thanks! |
meta-cla
Bot
added
the
CLA Signed
cixzhang
approved these changes
Jul 28, 2026
Han5991
added a commit
to Han5991/astryx
that referenced
this pull request
Jul 29, 2026
…atalog Re-verified every override entry by removing it, re-resolving the lockfile, and running pnpm audit. The entries that no longer do anything useful are removed: stylex, tmp, @babel/core, hono, both scoped js-yaml floors and the picomatch trio carried over from yarn resolutions all resolve identically without the override, and prettier and minimatch were dedup-only forces whose removal lets consumers follow their own declared ranges. brace-expansion ^2.1.2 goes too. It was added in facebook#4398 as a security floor, but 2.x sits below the declared range of every consumer in the graph — minimatch@10 (via @eslint/config-array) declares ^5.0.5, minimatch@3 (via @babel/cli) declares ^1.1.7 — so it was a downgrade, not a floor. It stayed invisible only because the equally stale minimatch ^9.0.7 force held minimatch on a line that still used brace-expansion's default CJS export. Dropping minimatch alone lets @eslint/config-array resolve minimatch 10, which calls the named `expand` that 2.x does not have, and ESLint dies with "brace_expansion_1.expand is not a function". Dropping both lets each consumer resolve inside its own range (5.0.7 and 1.1.16) and ESLint runs clean. The entries that guard live advisories stay, documented with the dependent that pins the vulnerable version and the condition for deleting them: postcss ^8.5.18 (next@15 pins 8.4.31), dompurify ^3.4.12 (monaco-editor@0.55 pins 3.2.7, 16 advisories), esbuild >=0.28.1 (tsup@8.5 resolves 0.27.7), fast-uri ^3.1.4 (facebook#4398), sharp ^0.35.3 (facebook#4449), and the read-yaml-file 2.x lift. Both js-yaml chains move to ^5.2.2, adopting the fix in facebook#4402 — the previous '>=4.2.0' floor was unbounded and resolved onto js-yaml 5.2.1, inside the vulnerable >=5.0.0 <=5.2.1 range. Written as a caret rather than '>=' so a future js-yaml 6 cannot repeat that. js-yaml@5.2.2 is added to minimumReleaseAgeExclude so the floor can resolve. Workspace-wide version pins that lived in overrides move to the pnpm catalog alongside vite: @stylexjs/stylex, @stylexjs/babel-plugin, prettier, esbuild. Peer ranges stay untouched — they are consumer contracts, not workspace pins. pnpm audit goes from 12 findings to 10; the remaining 10 match main's baseline exactly.
- js-yaml 4.x vulnerable to DoS via !!omap and flow collections - Patched in 5.2.2, requires overriding read-yaml-file>js-yaml and @changesets/parse>js-yaml - Verified with pnpm changeset status - Added js-yaml@5.2.2 to minimumReleaseAgeExclude
dhanji4U
force-pushed
the
fix/deps-js-yaml-5-4399
branch
from
July 29, 2026 11:23
60cf807 to
2c01be2
Compare
github-actions
Bot
removed
the
needs:code-review
Author
imdreamrunner
enabled auto-merge (squash)
July 31, 2026 06:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #4399
js-yaml 4.x vulnerable to DoS via !!omap and flow collections