From 3b419ddcaa7ab4507e93f1025f9874ea58af022c Mon Sep 17 00:00:00 2001 From: Chisanan232 Date: Tue, 21 Jul 2026 16:02:17 +0800 Subject: [PATCH] =?UTF-8?q?=E2=AC=86=EF=B8=8F=20(website):=20bump=20js-yam?= =?UTF-8?q?l=20+=20brace-expansion=20to=20patched=20(GHSA-52cp/GHSA-3jxr)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Resolve two dev-only DoS advisories in the standalone Docusaurus website/: - js-yaml GHSA-52cp-r559-cp3m (CVE-2026-59869): 4.2.0 → 4.3.0 - brace-expansion GHSA-3jxr-9vmj-r5cp (CVE-2026-13149): 1.1.14 → 1.1.16 and 5.0.5 → 5.0.7 Uses scoped ^ overrides (not bare >=) per this repo's pinning rule: a bare >= on the brace-expansion@1 key let the resolver bleed the 1.x consumer (minimatch@3.1.5) across the major boundary to the still-unpatched 5.0.5. The ^ form keeps each tree on its patched line. js-yaml 3.x is out of the advisory range and left untouched. Root SDK lockfile unaffected. refs AAASM-4971 --- website/package.json | 4 +++- website/pnpm-lock.yaml | 42 ++++++++++++++++++++++-------------------- 2 files changed, 25 insertions(+), 21 deletions(-) diff --git a/website/package.json b/website/package.json index 8ab176cc0..9ece33b8a 100644 --- a/website/package.json +++ b/website/package.json @@ -61,8 +61,10 @@ "ws": ">=8.21.0", "dompurify": "^3.4.11", "joi": "^17.13.4", - "js-yaml@^4.0.0": "^4.2.0", + "js-yaml@^4.0.0": "^4.3.0", "js-yaml@3": "^3.15.0", + "brace-expansion@1": "^1.1.16", + "brace-expansion@5": "^5.0.7", "launch-editor": "^2.14.1", "markdown-it": "^14.2.0", "mermaid": "^11.15.0", diff --git a/website/pnpm-lock.yaml b/website/pnpm-lock.yaml index 74068ebb4..694ae91e9 100644 --- a/website/pnpm-lock.yaml +++ b/website/pnpm-lock.yaml @@ -13,8 +13,10 @@ overrides: ws: '>=8.21.0' dompurify: ^3.4.11 joi: ^17.13.4 - js-yaml@^4.0.0: ^4.2.0 + js-yaml@^4.0.0: ^4.3.0 js-yaml@3: ^3.15.0 + brace-expansion@1: ^1.1.16 + brace-expansion@5: ^5.0.7 launch-editor: ^2.14.1 markdown-it: ^14.2.0 mermaid: ^11.15.0 @@ -2694,11 +2696,11 @@ packages: resolution: {integrity: sha512-2hCgjEmP8YLWQ130n2FerGv7rYpfBmnmp9Uy2Le1vge6X3gZIfSmEzP5QTDElFxcvVcXlEn8Aq6MU/PZygIOog==} engines: {node: '>=14.16'} - brace-expansion@1.1.14: - resolution: {integrity: sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==} + brace-expansion@1.1.16: + resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==} - brace-expansion@5.0.5: - resolution: {integrity: sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==} + brace-expansion@5.0.7: + resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} engines: {node: 18 || 20 || >=22} braces@3.0.3: @@ -4147,8 +4149,8 @@ packages: resolution: {integrity: sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==} hasBin: true - js-yaml@4.2.0: - resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==} + js-yaml@4.3.0: + resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} hasBin: true jsesc@3.1.0: @@ -6231,7 +6233,7 @@ snapshots: '@11ty/gray-matter@1.0.0': dependencies: - js-yaml: 4.2.0 + js-yaml: 4.3.0 kind-of: 6.0.3 section-matter: 1.0.0 strip-bom-string: 1.0.0 @@ -8013,7 +8015,7 @@ snapshots: '@types/react-router-config': 5.0.11 combine-promises: 1.2.0 fs-extra: 11.3.4 - js-yaml: 4.2.0 + js-yaml: 4.3.0 lodash: 4.18.1 react: 19.2.7 react-dom: 19.2.7(react@19.2.7) @@ -8052,7 +8054,7 @@ snapshots: '@types/react-router-config': 5.0.11 combine-promises: 1.2.0 fs-extra: 11.3.4 - js-yaml: 4.2.0 + js-yaml: 4.3.0 lodash: 4.18.1 react: 19.2.7 react-dom: 19.2.7(react@19.2.7) @@ -8589,7 +8591,7 @@ snapshots: '@docusaurus/utils-common': 3.10.1(@swc/core@1.15.43)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) fs-extra: 11.3.4 joi: 17.13.4 - js-yaml: 4.2.0 + js-yaml: 4.3.0 lodash: 4.18.1 tslib: 2.8.1 transitivePeerDependencies: @@ -8608,7 +8610,7 @@ snapshots: '@docusaurus/utils-common': 3.10.2(@swc/core@1.15.43)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) fs-extra: 11.3.4 joi: 17.13.4 - js-yaml: 4.2.0 + js-yaml: 4.3.0 lodash: 4.18.1 tslib: 2.8.1 transitivePeerDependencies: @@ -8633,7 +8635,7 @@ snapshots: globby: 11.1.0 gray-matter: 4.0.3 jiti: 1.21.7 - js-yaml: 4.2.0 + js-yaml: 4.3.0 lodash: 4.18.1 micromatch: 4.0.8 p-queue: 6.6.2 @@ -8665,7 +8667,7 @@ snapshots: github-slugger: 1.5.0 globby: 11.1.0 jiti: 1.21.7 - js-yaml: 4.2.0 + js-yaml: 4.3.0 lodash: 4.18.1 micromatch: 4.0.8 p-queue: 6.6.2 @@ -10119,12 +10121,12 @@ snapshots: widest-line: 4.0.1 wrap-ansi: 8.1.0 - brace-expansion@1.1.14: + brace-expansion@1.1.16: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@5.0.5: + brace-expansion@5.0.7: dependencies: balanced-match: 4.0.4 @@ -10403,7 +10405,7 @@ snapshots: cosmiconfig@8.3.6(typescript@6.0.3): dependencies: import-fresh: 3.3.1 - js-yaml: 4.2.0 + js-yaml: 4.3.0 parse-json: 5.2.0 path-type: 4.0.0 optionalDependencies: @@ -11702,7 +11704,7 @@ snapshots: argparse: 1.0.10 esprima: 4.0.1 - js-yaml@4.2.0: + js-yaml@4.3.0: dependencies: argparse: 2.0.1 @@ -12456,11 +12458,11 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.5 + brace-expansion: 5.0.7 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.14 + brace-expansion: 1.1.16 minimist@1.2.8: {}