From 301da20aabd18982f5cd12417a8f786c686ee951 Mon Sep 17 00:00:00 2001 From: Ben Papp Date: Tue, 24 Mar 2026 18:18:50 +0000 Subject: [PATCH] Override js-yaml@<=2.0.4 to 3.14.2 to fix code execution vulnerability --- common/config/rush/pnpm-config.json | 5 ++- .../build-tests-subspace/pnpm-lock.yaml | 1 + .../build-tests-subspace/repo-state.json | 2 +- .../config/subspaces/default/pnpm-lock.yaml | 35 ++++++++++--------- .../config/subspaces/default/repo-state.json | 2 +- 5 files changed, 25 insertions(+), 20 deletions(-) diff --git a/common/config/rush/pnpm-config.json b/common/config/rush/pnpm-config.json index c07cc2d18a3..07b9038d426 100644 --- a/common/config/rush/pnpm-config.json +++ b/common/config/rush/pnpm-config.json @@ -252,7 +252,10 @@ "loader-utils@^2.0.0": "2.0.4", // `fast-xml-parser@5.3.3` has a vulnerability - "fast-xml-parser@^5.3.3": "5.3.5" + "fast-xml-parser@^5.3.3": "5.3.5", + + // `js-yaml@<=2.0.4` has a code execution vulnerability in the YAML deserializer + "js-yaml@<=2.0.4": "3.14.2" }, /** diff --git a/common/config/subspaces/build-tests-subspace/pnpm-lock.yaml b/common/config/subspaces/build-tests-subspace/pnpm-lock.yaml index e727c7f1134..dbf3690cef3 100644 --- a/common/config/subspaces/build-tests-subspace/pnpm-lock.yaml +++ b/common/config/subspaces/build-tests-subspace/pnpm-lock.yaml @@ -11,6 +11,7 @@ overrides: '@vscode/vsce>cheerio': 1.0.0-rc.12 loader-utils@^2.0.0: 2.0.4 fast-xml-parser@^5.3.3: 5.3.5 + js-yaml@<=2.0.4: 3.14.2 packageExtensionsChecksum: sha256-8fXYR9X9qRA57SZJJSADz6C9KMP6QQYYut4DHyehah0= diff --git a/common/config/subspaces/build-tests-subspace/repo-state.json b/common/config/subspaces/build-tests-subspace/repo-state.json index bd056c2ae6e..cb97b06a51c 100644 --- a/common/config/subspaces/build-tests-subspace/repo-state.json +++ b/common/config/subspaces/build-tests-subspace/repo-state.json @@ -1,6 +1,6 @@ // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush. { - "pnpmShrinkwrapHash": "ae06e3ff5f65c89fd6b5c88cb4bce597f4a5aa18", + "pnpmShrinkwrapHash": "f59fe35322490ebd9e2c6f874d37b8a55247ecc3", "preferredVersionsHash": "550b4cee0bef4e97db6c6aad726df5149d20e7d9", "packageJsonInjectedDependenciesHash": "fa90a0a032a0046e646e8751bbc6d0be86a4dda1" } diff --git a/common/config/subspaces/default/pnpm-lock.yaml b/common/config/subspaces/default/pnpm-lock.yaml index 9c00b0b7596..647910a1de9 100644 --- a/common/config/subspaces/default/pnpm-lock.yaml +++ b/common/config/subspaces/default/pnpm-lock.yaml @@ -11,6 +11,7 @@ overrides: '@vscode/vsce>cheerio': 1.0.0-rc.12 loader-utils@^2.0.0: 2.0.4 fast-xml-parser@^5.3.3: 5.3.5 + js-yaml@<=2.0.4: 3.14.2 packageExtensionsChecksum: sha256-8fXYR9X9qRA57SZJJSADz6C9KMP6QQYYut4DHyehah0= @@ -782,7 +783,7 @@ importers: version: 6.4.22(@types/react@17.0.74)(react-dom@17.0.2(react@17.0.2))(react@17.0.2) '@storybook/cli': specifier: ~6.4.18 - version: 6.4.22(eslint@9.37.0)(jest@29.3.1(@types/node@20.17.19)(babel-plugin-macros@3.1.0))(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(typescript@5.8.2) + version: 6.4.22(eslint@9.37.0)(jest@29.3.1(@types/node@20.17.19))(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(typescript@5.8.2) '@storybook/components': specifier: ~6.4.18 version: 6.4.22(@types/react@17.0.74)(react-dom@17.0.2(react@17.0.2))(react@17.0.2) @@ -818,7 +819,7 @@ importers: version: 5.2.7(webpack@4.47.0) jest: specifier: ~29.3.1 - version: 29.3.1(@types/node@20.17.19)(babel-plugin-macros@3.1.0) + version: 29.3.1(@types/node@20.17.19) react: specifier: ~17.0.2 version: 17.0.2 @@ -1004,7 +1005,7 @@ importers: version: 5.2.7(webpack@5.105.2) jest: specifier: ~29.3.1 - version: 29.3.1(@types/node@20.17.19)(babel-plugin-macros@3.1.0) + version: 29.3.1(@types/node@20.17.19) react: specifier: ~19.2.3 version: 19.2.4 @@ -22427,7 +22428,7 @@ snapshots: - supports-color - ts-node - '@jest/core@29.7.0(babel-plugin-macros@3.1.0)': + '@jest/core@29.7.0': dependencies: '@jest/console': 29.7.0 '@jest/reporters': 29.7.0 @@ -22441,7 +22442,7 @@ snapshots: exit: 0.1.2 graceful-fs: 4.2.11 jest-changed-files: 29.7.0 - jest-config: 29.7.0(@types/node@22.9.3)(babel-plugin-macros@3.1.0) + jest-config: 29.7.0(@types/node@22.9.3) jest-haste-map: 29.7.0 jest-message-util: 29.7.0 jest-regex-util: 29.6.3 @@ -25154,7 +25155,7 @@ snapshots: ts-dedent: 2.2.0 util-deprecate: 1.0.2 - '@storybook/cli@6.4.22(eslint@9.37.0)(jest@29.3.1(@types/node@20.17.19)(babel-plugin-macros@3.1.0))(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(typescript@5.8.2)': + '@storybook/cli@6.4.22(eslint@9.37.0)(jest@29.3.1(@types/node@20.17.19))(react-dom@17.0.2(react@17.0.2))(react@17.0.2)(typescript@5.8.2)': dependencies: '@babel/core': 7.20.12 '@babel/preset-env': 7.28.6(@babel/core@7.20.12) @@ -25174,7 +25175,7 @@ snapshots: fs-extra: 9.1.0 get-port: 5.1.1 globby: 11.1.0 - jest: 29.3.1(@types/node@20.17.19)(babel-plugin-macros@3.1.0) + jest: 29.3.1(@types/node@20.17.19) jscodeshift: 0.13.1(@babel/preset-env@7.28.6(@babel/core@7.20.12)) json5: 2.2.3 leven: 3.1.0 @@ -28767,13 +28768,13 @@ snapshots: safe-buffer: 5.2.1 sha.js: 2.4.12 - create-jest@29.7.0(@types/node@20.17.19)(babel-plugin-macros@3.1.0): + create-jest@29.7.0(@types/node@20.17.19): dependencies: '@jest/types': 29.6.3 chalk: 4.1.2 exit: 0.1.2 graceful-fs: 4.2.11 - jest-config: 29.7.0(@types/node@20.17.19)(babel-plugin-macros@3.1.0) + jest-config: 29.7.0(@types/node@20.17.19) jest-util: 29.7.0 prompts: 2.4.2 transitivePeerDependencies: @@ -32145,16 +32146,16 @@ snapshots: - babel-plugin-macros - supports-color - jest-cli@29.7.0(@types/node@20.17.19)(babel-plugin-macros@3.1.0): + jest-cli@29.7.0(@types/node@20.17.19): dependencies: - '@jest/core': 29.7.0(babel-plugin-macros@3.1.0) + '@jest/core': 29.7.0 '@jest/test-result': 29.7.0(@types/node@20.17.19) '@jest/types': 29.6.3 chalk: 4.1.2 - create-jest: 29.7.0(@types/node@20.17.19)(babel-plugin-macros@3.1.0) + create-jest: 29.7.0(@types/node@20.17.19) exit: 0.1.2 import-local: 3.2.0 - jest-config: 29.7.0(@types/node@20.17.19)(babel-plugin-macros@3.1.0) + jest-config: 29.7.0(@types/node@20.17.19) jest-util: 29.7.0 jest-validate: 29.7.0 yargs: 17.7.2 @@ -32224,7 +32225,7 @@ snapshots: - babel-plugin-macros - supports-color - jest-config@29.7.0(@types/node@20.17.19)(babel-plugin-macros@3.1.0): + jest-config@29.7.0(@types/node@20.17.19): dependencies: '@babel/core': 7.20.12 '@jest/test-sequencer': 29.7.0(@types/node@20.17.19) @@ -32254,7 +32255,7 @@ snapshots: - babel-plugin-macros - supports-color - jest-config@29.7.0(@types/node@22.9.3)(babel-plugin-macros@3.1.0): + jest-config@29.7.0(@types/node@22.9.3): dependencies: '@babel/core': 7.20.12 '@jest/test-sequencer': 29.7.0(@types/node@22.9.3) @@ -32642,12 +32643,12 @@ snapshots: merge-stream: 2.0.0 supports-color: 8.1.1 - jest@29.3.1(@types/node@20.17.19)(babel-plugin-macros@3.1.0): + jest@29.3.1(@types/node@20.17.19): dependencies: '@jest/core': 29.5.0(babel-plugin-macros@3.1.0) '@jest/types': 29.5.0 import-local: 3.2.0 - jest-cli: 29.7.0(@types/node@20.17.19)(babel-plugin-macros@3.1.0) + jest-cli: 29.7.0(@types/node@20.17.19) transitivePeerDependencies: - '@types/node' - babel-plugin-macros diff --git a/common/config/subspaces/default/repo-state.json b/common/config/subspaces/default/repo-state.json index 0c7522683f8..46caab53af2 100644 --- a/common/config/subspaces/default/repo-state.json +++ b/common/config/subspaces/default/repo-state.json @@ -1,5 +1,5 @@ // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush. { - "pnpmShrinkwrapHash": "54470e7caa94b190d86dbd4f9cc43e0d58456972", + "pnpmShrinkwrapHash": "7fb212a92af318a9c2fc802013033ba28900ae62", "preferredVersionsHash": "029c99bd6e65c5e1f25e2848340509811ff9753c" }