fix(deps): bump js-yaml and brace-expansion out of their advisories - #31
Merged
Conversation
Both are dev-only transitive dependencies and neither can reach anyone who installs this package — "files" ships dist/, README and LICENSE, so no lockfile and no dev tree goes with it. The exposure is the local and CI toolchain only. js-yaml 4.3.0 -> 4.3.1 quadratic CPU on !!omap (CVE-2026-59870), via @eslint/eslintrc brace-expansion 1.1.17 -> 1.1.18 DoS via unbounded intermediate arrays (GHSA-rgw5-rvv9-x895), via minimatch The 5.x copy of brace-expansion under @typescript-eslint/typescript-estree was already carried to 5.0.9 by the typescript-eslint 8.66.0 bump in #26. Lockfile only: both existing ranges already admitted the fixed versions, so package.json is untouched and no direct dependency changes. Verified with a clean `npm ci` — lint, format, both tsconfigs and the full suite pass, and `npm audit` reports zero. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
mschmicking
force-pushed
the
fix/js-yaml-advisory
branch
from
August 17, 2026 21:41
e8b79f1 to
89f479b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Lockfile-only bumps clearing two high-severity advisories:
js-yaml!!omap(CVE-2026-59870 not backported)@eslint/eslintrcbrace-expansionminimatchbrace-expansion@typescript-eslint/typescript-estreejs-yamlis Dependabot alert #4. Thebrace-expansionpair had not been raised yet and turned up innpm auditwhile fixing it; same class and same triviality, so it is folded in here rather than left open.Impact
Neither can reach anyone who installs the package. Both are dev-only and transitive, and
filesshipsdist/,README.mdandLICENSE— no lockfile and no dev tree go with it. The exposure is the local and CI toolchain only, with hostile YAML or a hostile glob as the vector.Scope
package.jsonis untouched: both existing ranges already admitted the fixed versions, so this is nine lines ofpackage-lock.jsonand no direct dependency moved.Testing
Verified with a real
npm cirather thannpm install— the latter called the old tree "up to date" and left 4.3.0 in place. On the fresh install: lint, format check, both tsconfigs and the full test suite pass, andnpm auditreportsfound 0 vulnerabilities.🤖 Generated with Claude Code