From 4476894e417e1f0297c2ba9e063d6a11aa6ea097 Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Mon, 14 Sep 2026 07:13:46 -0400 Subject: [PATCH] fix(deps): pin js-yaml to the GHSA-2883-xcg3-v3hh patched releases The Dependency Audit gate on main has failed since the advisory published on 2026-09-08 (run 34827360640: 'Severity: 2 moderate | 4 high (2 ignored)', exit 1). GHSA-2883-xcg3-v3hh (high, js-yaml maxTotalMergeKeys does not limit CPU use for empty merge sources) names 3.15.2 and 4.3.2 as the first patched releases. Both overrides sat exactly one patch below: 3.15.1 and 4.3.1. js-yaml reaches this tree only transitively, through metro/cosmiconfig (962 paths) and @expo/cli/@expo/xcpretty (32 paths), so the overrides are the only place to fix it. Verified locally by reproducing the workflow exactly (@nself stubs, pnpm install --no-frozen-lockfile, pnpm audit --audit-level=high): exit 0, '2 moderate | 2 high (2 ignored)', with js-yaml@3.15.2 and js-yaml@4.3.2 resolved in the store. The two remaining ignored advisories are unchanged and still have no fix: GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq (image-size) both report first_patched_version NONE against <= 2.0.2, which is still npm latest. --- package.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index a7a4a96..1c86c35 100644 --- a/package.json +++ b/package.json @@ -74,8 +74,8 @@ "brace-expansion@1": "1.1.18", "brace-expansion@2": "2.1.4", "brace-expansion@5": "5.0.9", - "js-yaml@3": "3.15.1", - "js-yaml@4": "4.3.1", + "js-yaml@3": "3.15.2", + "js-yaml@4": "4.3.2", "undici@7": "7.29.0", "nanoid@3": "3.3.18", "browserslist@<4.28.7": "^4.28.7"