From b098e7f2864be5c97fd69b7f2d34515f6bf0e964 Mon Sep 17 00:00:00 2001 From: maziggy Date: Wed, 30 Sep 2026 08:09:57 +0200 Subject: [PATCH] security(frontend): pin js-yaml to 5.4.1+ Raise the js-yaml override from ^5.2.3 to ^5.4.1. Versions up to 5.4.0 do not count empty mappings towards maxTotalMergeKeys, so a small YAML file can keep the CPU busy for a long time. js-yaml is a dev-only transitive dependency of eslint and only parses our own ESLint configs. --- frontend/package-lock.json | 6 +++--- frontend/package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index b0c0bef9a..e64b59e2b 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -4861,9 +4861,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "5.2.3", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.3.tgz", - "integrity": "sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==", + "version": "5.4.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.2.tgz", + "integrity": "sha512-m+aqu+LwO1O6sIopafj8HUVl5aawITwZQe/yHpMCKjaWBaA/d07B/QdMb3529REftiU+RMMHL3Vlsw3hON7vWg==", "dev": true, "funding": [ { diff --git a/frontend/package.json b/frontend/package.json index a97f04547..48f247bda 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -57,7 +57,7 @@ "overrides": { "minimatch": "^10.2.1", "brace-expansion": "^5.0.9", - "js-yaml": "^5.2.3", + "js-yaml": "^5.4.1", "nanoid": "^3.3.18", "react-router": "7.18.2" },