build(deps): Upgrade js-yaml 4.x to 4.1.1 to fix GHSA-mh29-5h37-fv8m#209
Merged
build(deps): Upgrade js-yaml 4.x to 4.1.1 to fix GHSA-mh29-5h37-fv8m#209
Conversation
The same advisory also affects js-yaml@4.1.0 (fixed in 4.1.1). This instance is pulled in by eslint@8.56.0 and @eslint/eslintrc@2.1.4, both of which require js-yaml@^4.1.0. No resolutions override is added: a broad "js-yaml" entry cannot safely pin both the 3.x and 4.x instances simultaneously since the two major versions have incompatible APIs (safeLoad/safeDump were removed in 4.x). Since ^4.1.0 naturally satisfies 4.1.1, removing the stale lockfile entry is sufficient. Co-Authored-By: Claude <noreply@anthropic.com>
alex-sentry
approved these changes
Feb 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #208 — the same advisory (GHSA-mh29-5h37-fv8m) also covers js-yaml@4.1.0, fixed in 4.1.1. The previous PR addressed the 3.x instance; this one addresses the 4.x instance used by eslint.
The vulnerable
js-yaml@^4.1.0 → 4.1.0entry comes fromeslint@8.56.0and@eslint/eslintrc@2.1.4. Since^4.1.0naturally satisfies 4.1.1, removing the stale lockfile entry is sufficient for yarn to re-resolve to the patched release.No
resolutionsoverride is added for js-yaml. Unlike minimatch (where 9.x and 3.x share the same CJS API), js-yaml 3.x and 4.x have incompatible interfaces —safeLoad/safeDumpwere removed in 4.x — so a single broad resolution would break either the eslint (4.x) or the jest/istanbul (3.x) instance.