default.json caps js-yaml below v5 for npm repos, because @analogjs/content requires front-matter@^4.0.2 as a peer and that package pins js-yaml ^3.13.1. v5 builds a tree where front-matter calls an API js-yaml no longer has, and the site build dies at config load with TypeError: loader is not a function.
Seven sites consume @analogjs/content today: FerrFlow-Cloud, FerrVault-Cloud, FerrTrack-Cloud, FerrGrowth-Cloud, FerrFleet-Cloud, FerrLens-Cloud and FerrLabs-Cloud.
Drop the rule when Analog stops requiring front-matter, or when front-matter widens its js-yaml range. Until then the cap costs nothing: GHSA-2883-xcg3-v3hh is fixed on 3.15.2 and 4.3.2, so a tree held on 3.x or 4.x is remediated, and v5 itself carries GHSA-pm4m-ph32-ghv5 below 5.2.2.
Checking whether it can go: pnpm why front-matter in any site, or read @analogjs/content's peerDependencies.
default.jsoncapsjs-yamlbelow v5 for npm repos, because@analogjs/contentrequiresfront-matter@^4.0.2as a peer and that package pinsjs-yaml ^3.13.1. v5 builds a tree wherefront-mattercalls an API js-yaml no longer has, and the site build dies at config load withTypeError: loader is not a function.Seven sites consume
@analogjs/contenttoday: FerrFlow-Cloud, FerrVault-Cloud, FerrTrack-Cloud, FerrGrowth-Cloud, FerrFleet-Cloud, FerrLens-Cloud and FerrLabs-Cloud.Drop the rule when Analog stops requiring
front-matter, or whenfront-matterwidens its js-yaml range. Until then the cap costs nothing: GHSA-2883-xcg3-v3hh is fixed on 3.15.2 and 4.3.2, so a tree held on 3.x or 4.x is remediated, and v5 itself carries GHSA-pm4m-ph32-ghv5 below 5.2.2.Checking whether it can go:
pnpm why front-matterin any site, or read@analogjs/content'speerDependencies.