From 8313e91200742cad02888d04745f52e4f52ffa2e Mon Sep 17 00:00:00 2001 From: Stefan Kruger Date: Sat, 25 Jul 2026 11:00:14 +0100 Subject: [PATCH] security: consolidated medium-severity remediation Force-override js-yaml to patched within-major versions to close out the three open MEDIUM Dependabot alerts (GHSA-h67p-54hq-rp68, quadratic-complexity DoS in merge-key handling): - root: js-yaml ^4.1.0 (eslint/@eslint/eslintrc) 4.1.1 -> 4.2.0 (alert #8) - root: js-yaml ^3.13.1 (@istanbuljs/load-nyc-config) 3.14.2 -> 3.15.0 (alert #7) - mcp: js-yaml ^3.13.1 (@istanbuljs/load-nyc-config) 3.14.2 -> 3.15.0 (alert #6) All dev-scoped transitive; scoped overrides keep the 3.x and 4.x lines on their own majors (no forced major bump). Lockfiles regenerated; lint, tests, coverage, MCP build and bundle-size gate all pass locally. --- mcp/lua-platform/package-lock.json | 6 +++--- mcp/lua-platform/package.json | 3 ++- package-lock.json | 22 ++++++++++++++++------ package.json | 4 +++- 4 files changed, 24 insertions(+), 11 deletions(-) diff --git a/mcp/lua-platform/package-lock.json b/mcp/lua-platform/package-lock.json index 5ffa7e7..7ab2851 100644 --- a/mcp/lua-platform/package-lock.json +++ b/mcp/lua-platform/package-lock.json @@ -3207,9 +3207,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "dev": true, "license": "MIT", "dependencies": { diff --git a/mcp/lua-platform/package.json b/mcp/lua-platform/package.json index 9b56aa2..711eaf6 100644 --- a/mcp/lua-platform/package.json +++ b/mcp/lua-platform/package.json @@ -25,6 +25,7 @@ "typescript": "^5.3.0" }, "overrides": { - "@babel/core": "^7.29.6" + "@babel/core": "^7.29.6", + "js-yaml@^3.13.1": "3.15.0" } } diff --git a/package-lock.json b/package-lock.json index 1207097..06639fe 100644 --- a/package-lock.json +++ b/package-lock.json @@ -655,9 +655,9 @@ } }, "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "dev": true, "license": "MIT", "dependencies": { @@ -3306,10 +3306,20 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", - "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", + "version": "4.2.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", + "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], "license": "MIT", "dependencies": { "argparse": "^2.0.1" diff --git a/package.json b/package.json index 60925d1..b9646f1 100644 --- a/package.json +++ b/package.json @@ -19,6 +19,8 @@ "jest": "^29.7.0" }, "overrides": { - "@babel/core": "^7.29.6" + "@babel/core": "^7.29.6", + "js-yaml@^4.1.0": "4.2.0", + "js-yaml@^3.13.1": "3.15.0" } }