From 593c3dfb6f4a021614ab9229a152d8c11d53a3e0 Mon Sep 17 00:00:00 2001
From: Thomas Maas <thomas@webtypes.com>
Date: Wed, 2 Sep 2026 16:51:37 +0200
Subject: [PATCH] Bump js-yaml to ^4.3.2 to fix prototype pollution
 vulnerability

Direct dependency updated from ^4.3.1 to ^4.3.2 and resolutions pin
added to force transitive consumers to the fixed version.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Thomas Maas <thomas@webtypes.com>
---
 package.json |  5 +++--
 yarn.lock    | 48 +++++++-----------------------------------------
 2 files changed, 10 insertions(+), 43 deletions(-)

diff --git a/package.json b/package.json
index ab65dda1..f35ae5a7 100644
--- a/package.json
+++ b/package.json
@@ -36,7 +36,8 @@
     "qs": "6.14.1",
     "brace-expansion@^5": "^5.0.7",
     "nanoid": "3.3.18",
-    "browserslist": "^4.28.7"
+    "browserslist": "^4.28.7",
+    "js-yaml": "^4.3.2"
   },
   "devDependencies": {
     "@openshift-console/dynamic-plugin-sdk": "patch:@openshift-console/dynamic-plugin-sdk@npm%3A4.22.0#~/.yarn/patches/@openshift-console-dynamic-plugin-sdk-npm-4.22.0-40a905f3df.patch",
@@ -146,7 +147,7 @@
     "graphlib-dot": "^0.6.4",
     "i18next": "^25.8.0",
     "i18next-parser": "^9.0.1",
-    "js-yaml": "^4.3.1",
+    "js-yaml": "^4.3.2",
     "nanoid": "3.3.18",
     "pluralize": "^8.0.0",
     "swagger-ui-react": "5.10.5"
diff --git a/yarn.lock b/yarn.lock
index a9bcc4f0..77a81f49 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -5788,7 +5788,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"argparse@npm:^1.0.10, argparse@npm:^1.0.7":
+"argparse@npm:^1.0.10":
   version: 1.0.10
   resolution: "argparse@npm:1.0.10"
   dependencies:
@@ -9019,7 +9019,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"esprima@npm:^4.0.0, esprima@npm:^4.0.1":
+"esprima@npm:^4.0.1":
   version: 4.0.1
   resolution: "esprima@npm:4.0.1"
   bin:
@@ -12425,48 +12425,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"js-yaml@npm:4.1.0, js-yaml@npm:=4.1.0":
-  version: 4.1.0
-  resolution: "js-yaml@npm:4.1.0"
-  dependencies:
-    argparse: "npm:^2.0.1"
-  bin:
-    js-yaml: bin/js-yaml.js
-  checksum: 10c0/184a24b4eaacfce40ad9074c64fd42ac83cf74d8c8cd137718d456ced75051229e5061b8633c3366b8aada17945a7a356b337828c19da92b51ae62126575018f
-  languageName: node
-  linkType: hard
-
-"js-yaml@npm:^3.13.1, js-yaml@npm:^3.9.0":
-  version: 3.15.0
-  resolution: "js-yaml@npm:3.15.0"
-  dependencies:
-    argparse: "npm:^1.0.7"
-    esprima: "npm:^4.0.0"
-  bin:
-    js-yaml: bin/js-yaml.js
-  checksum: 10c0/ca966bd354ac5b1b7a4694ebdba46526796aa3a6a99529fa540af2abf85918bd155a50ccc0166b413130a00622999973754458ec01e7095bc902177bfdbd5b64
-  languageName: node
-  linkType: hard
-
-"js-yaml@npm:^4.1.0":
-  version: 4.3.0
-  resolution: "js-yaml@npm:4.3.0"
-  dependencies:
-    argparse: "npm:^2.0.1"
-  bin:
-    js-yaml: bin/js-yaml.js
-  checksum: 10c0/058b30473d6915ca5b4feb11e2f7d4d97242f98d00a798ed48dd90b46b7c640398afe9128c5db22c5300f8c6528fe2a174b9a93f351a70ebc28c6203938d8bff
-  languageName: node
-  linkType: hard
-
-"js-yaml@npm:^4.3.1":
-  version: 4.3.1
-  resolution: "js-yaml@npm:4.3.1"
+"js-yaml@npm:^4.3.2":
+  version: 4.3.2
+  resolution: "js-yaml@npm:4.3.2"
   dependencies:
     argparse: "npm:^2.0.1"
   bin:
     js-yaml: bin/js-yaml.js
-  checksum: 10c0/13c500ca322e0c3f8c81686e6ecda96d2ea37b45247a420c17c7db36932d6965cc27391abc2d1a104501600e7f0d947a5f8b7be6db619c4fefa87901b3512807
+  checksum: 10c0/dedd34c2e8fef1d504687f1bc94ed0ee1311a1f78770fa2800352c6d59c635ccf555009d74e9afe529ae62199da2b1ccef30e53dc84dcd8d2d8187c22574bc97
   languageName: node
   linkType: hard
 
@@ -12870,7 +12836,7 @@ __metadata:
     i18next-parser: "npm:^9.0.1"
     jest: "npm:^30.5.0"
     jest-environment-jsdom: "npm:^30.5.0"
-    js-yaml: "npm:^4.3.1"
+    js-yaml: "npm:^4.3.2"
     nanoid: "npm:3.3.18"
     pluralize: "npm:^8.0.0"
     prettier: "npm:^2.7.1"