Upgrades js-yaml (npm) from 4.1.0 to 4.3.2, which fixes these known vulnerabilities:
| Advisory | Severity | Affected | Fixed in | Summary |
|---|---|---|---|---|
| GHSA-2883-xcg3-v3hh | high | 4.1.0 | 4.3.2 | js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources |
| GHSA-52cp-r559-cp3m | high | 4.1.0 | 4.3.0 | js-yaml: YAML merge-key chains can force quadratic CPU consumption |
| GHSA-5p4m-2wfm-xmqj | high | 4.1.0 | 4.3.1 | JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported |
| GHSA-h67p-54hq-rp68 | medium | 4.1.0 | 4.2.0 | JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases |
| GHSA-mh29-5h37-fv8m | medium | 4.1.0 | 4.1.1 | js-yaml has prototype pollution in merge (<<) |
Lockfiles changed: src/package-lock.json.
Only the version changes. This pull request lands through this branch's required checks like any other. If they fail because code has to change, g1t closes it and puts g1t on an issue to make the change.
Opened by g1t's security updates. Turn them off for this project on its Security page.