fix(root): bump js-yaml 4.3.0 -> 4.3.1 to unblock release (HIGH osv finding) - #9445
Merged
Conversation
js-yaml@4.3.0 is affected by GHSA-5p4m-2wfm-xmqj (CVSS 7.5, HIGH): quadratic CPU consumption in !!omap resolution, a DoS vector. This is the only advisory group at/above CVSS 7.0, so it fails the release severity gate (.github/workflows/publish.yml -> osv-severity-gate). The root resolutions/overrides already pinned js-yaml to 4.3.0, which is itself vulnerable. Bump both pins to the patched v4 release 4.3.1 (same v4 API) and update the single lockfile block. js-yaml is dev-tooling only here (lerna, eslint, depcheck, cosmiconfig, mocha, nyc). Validated: yarn install --frozen-lockfile passes; yarn check-deps passes; yarn why js-yaml resolves to 4.3.1; no js-yaml < 4.3.1 remains in yarn.lock. TICKET: WCN-2047 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
zahin-mohammad
marked this pull request as ready for review
August 7, 2026 02:22
therealdwright
approved these changes
Aug 7, 2026
sijuu
approved these changes
Aug 7, 2026
lokesh-bitgo
approved these changes
Aug 7, 2026
diksha190
approved these changes
Aug 7, 2026
diksha190
left a comment
diksha190
left a comment
There was a problem hiding this comment.
Approved.
SafeChain cooldown-blocked (6.5 days, age-only),
Socket deep score 84, no high/critical alerts.
Package: js-yaml@4.3.1.
Condition: dev-tooling only, fixes CVE-2026-59870 (CVSS 7.5).
Age flagged but waived given clean scan + fix urgency
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/publish.yml→osv-severity-gate) fails: 1 of 37 advisory groups is ≥ CVSS 7.0. The gate fails only on HIGH/CRITICAL; the other 36 are sub-threshold.js-yaml@4.3.0—GHSA-5p4m-2wfm-xmqj, CVSS 7.5 (HIGH): quadratic CPU consumption in!!omapresolution (objectKeys.indexOflinear scan inside the per-element loop → event-loop DoS). Affected>=4.0.0 <4.3.1; first patched 4.3.1.resolutions/overridesalready pinned js-yaml to4.3.0(itself vulnerable). This bumps both pins to4.3.1(same v4 API) and updates the singleyarn.lockblock. js-yaml is dev-tooling only here (lerna, eslint, depcheck, cosmiconfig, mocha, nyc) — no runtime path.Test plan
yarn install --frozen-lockfilepasses (matches CI'ssfw yarn install --with-frozen-lockfile)yarn check-depspassesyarn why js-yaml→4.3.1; no js-yaml< 4.3.1remains inyarn.lockosv-severity-gatereports 0 groups ≥ 7.0Out of scope
Four advisory groups sit at CVSS 6.9 (
http-proxy-middleware,react-router-dom,tar,valibot); a rescore of any one re-blocks the release. Tracked in WCN-2047 as follow-up.Ticket: WCN-2047
🤖 Generated with Claude Code