From 182a30a5e995b3fd88792a243ea3ec5147db4f58 Mon Sep 17 00:00:00 2001 From: Pierre Brisorgueil Date: Mon, 31 Aug 2026 10:59:00 +0200 Subject: [PATCH] fix(deps): bump js-yaml to 4.3.2 to close CVE-2026-59870 js-yaml < 4.3.1 allows quadratic CPU consumption through !!omap resolution, and < 4.3.0 through YAML merge-key chains. Both are reported as high severity against the runtime scope, since lib/services/express.js parses the OpenAPI spec with js-yaml at boot. Stays on the 4.x line: 4.3.2 is inside the existing ^4.2.0 range, so this is a lockfile-level fix with no source change. The v5 line drops the ESM default export and switches load() to CORE_SCHEMA, which would need a code migration and carries behaviour risk on the OpenAPI spec parsing. --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 59c2f618d..bf539711d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -25,7 +25,7 @@ "handlebars": "^4.7.9", "helmet": "~8.2.0", "inquirer": "^14.0.2", - "js-yaml": "^4.2.0", + "js-yaml": "^4.3.2", "jsonwebtoken": "^9.0.3", "lodash": "^4.18.1", "lusca": "^1.7.0", @@ -13575,9 +13575,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "funding": [ { "type": "github", diff --git a/package.json b/package.json index 55f19717e..3e8846743 100644 --- a/package.json +++ b/package.json @@ -65,7 +65,7 @@ "handlebars": "^4.7.9", "helmet": "~8.2.0", "inquirer": "^14.0.2", - "js-yaml": "^4.2.0", + "js-yaml": "^4.3.2", "jsonwebtoken": "^9.0.3", "lodash": "^4.18.1", "lusca": "^1.7.0",