From 35df20e456d456e26dc09c1202ee47766e3d2b6b Mon Sep 17 00:00:00 2001 From: Valerii Svydenko Date: Fri, 4 Sep 2026 11:58:34 +0300 Subject: [PATCH 1/2] build(deps): bump js-yaml from 4.3.1 to 4.3.2 Addresses CVE-2026-84375: DoS via unbounded merge key processing in js-yaml < 4.3.2. Co-Authored-By: Claude Opus 4.6 Signed-off-by: Valerii Svydenko --- cli/yarn.lock | 6 +++--- webui/yarn.lock | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/cli/yarn.lock b/cli/yarn.lock index 674273896..9dd2e0423 100644 --- a/cli/yarn.lock +++ b/cli/yarn.lock @@ -3524,13 +3524,13 @@ __metadata: linkType: hard "js-yaml@npm:^4.1.0, js-yaml@npm:^4.1.1": - version: 4.3.1 - resolution: "js-yaml@npm:4.3.1" + version: 4.3.2 + resolution: "js-yaml@npm:4.3.2" dependencies: argparse: "npm:^2.0.1" bin: js-yaml: bin/js-yaml.js - checksum: 10/2ce71b5d632abbd77da80447bf860e8a0264e54bffe94840984887d58b023761495b523727547904517a6107a1ef189854b361e0fc44995ee13a84f222d7bd42 + checksum: 10/05c44b9c73e4901d92703b155e76518df64bf01ac62e4c036b47de4b391e19b72e32656e8954d51b436307f08cc9d0c0d4ec617d061cf2f65fffee9f3114bee7 languageName: node linkType: hard diff --git a/webui/yarn.lock b/webui/yarn.lock index 1a1b4d91d..9d1aae7b3 100644 --- a/webui/yarn.lock +++ b/webui/yarn.lock @@ -4866,13 +4866,13 @@ __metadata: linkType: hard "js-yaml@npm:^4.1.1": - version: 4.3.1 - resolution: "js-yaml@npm:4.3.1" + version: 4.3.2 + resolution: "js-yaml@npm:4.3.2" dependencies: argparse: "npm:^2.0.1" bin: js-yaml: bin/js-yaml.js - checksum: 10/2ce71b5d632abbd77da80447bf860e8a0264e54bffe94840984887d58b023761495b523727547904517a6107a1ef189854b361e0fc44995ee13a84f222d7bd42 + checksum: 10/05c44b9c73e4901d92703b155e76518df64bf01ac62e4c036b47de4b391e19b72e32656e8954d51b436307f08cc9d0c0d4ec617d061cf2f65fffee9f3114bee7 languageName: node linkType: hard From 6e3dbf8bbf7b9ce8b251c4fc09afa79e6137ddaa Mon Sep 17 00:00:00 2001 From: Thomas Neidhart Date: Fri, 4 Sep 2026 15:08:04 +0200 Subject: [PATCH 2/2] docs: add the changelog entries for the js-yaml bump The lockfile change touches both workspaces, so both changelogs get an entry. Kept to the terse form the surrounding Dependencies entries use; the CVE this addresses is described in the pull request, and js-yaml here is a transitive of the lint tooling rather than anything the published packages ship. Co-Authored-By: Claude Opus 5 (1M context) --- cli/CHANGELOG.md | 1 + webui/CHANGELOG.md | 1 + 2 files changed, 2 insertions(+) diff --git a/cli/CHANGELOG.md b/cli/CHANGELOG.md index 8e1b06c89..4059b1739 100644 --- a/cli/CHANGELOG.md +++ b/cli/CHANGELOG.md @@ -22,6 +22,7 @@ This change log covers only the command line interface (CLI) of Open VSX. - Bump fast-uri from 3.1.5 to 3.1.7 - Bump qs from 6.15.2 to 6.16.0 - Bump @humanfs/node from 0.16.6 to 0.16.8 +- Bump js-yaml from 4.3.1 to 4.3.2 ### [v1.1.1] (09/08/2026) diff --git a/webui/CHANGELOG.md b/webui/CHANGELOG.md index e0eaf3a3e..48efcf323 100644 --- a/webui/CHANGELOG.md +++ b/webui/CHANGELOG.md @@ -40,6 +40,7 @@ This change log covers only the frontend library (webui) of Open VSX. - Remove the `react-dropzone` dependency; the publish page and the navbar's drop target handle their own drag events, and nothing else imports it - Bump @humanfs/node from 0.16.6 to 0.16.8 +- Bump js-yaml from 4.3.1 to 4.3.2 ## [v1.1.2] (20/08/2026)