Summary
Dependabot reports an open high severity vulnerability in transitive dependency js-yaml:
Impact
js-yaml has a quadratic CPU consumption issue when parsing YAML merge-key chains, which can lead to denial-of-service via uncontrolled resource consumption.
Where it appears
package-lock.json currently resolves:
node_modules/js-yaml -> 4.2.0
Proposed fix
Update dependency graph so lockfile resolves js-yaml to 4.3.0 or later, then regenerate and commit package-lock.json.
Potential paths:
- Upgrade the parent dependency(ies) that pin older transitive versions.
- If needed, use npm overrides to force
js-yaml@^4.3.0 for the dependency tree.
Acceptance criteria
Summary
Dependabot reports an open high severity vulnerability in transitive dependency
js-yaml:GHSA-52cp-r559-cp3mCVE-2026-59869js-yaml(npm, transitive dev dependency)4.2.0(vulnerable)>= 4.3.0Impact
js-yamlhas a quadratic CPU consumption issue when parsing YAML merge-key chains, which can lead to denial-of-service via uncontrolled resource consumption.Where it appears
package-lock.jsoncurrently resolves:node_modules/js-yaml->4.2.0Proposed fix
Update dependency graph so lockfile resolves
js-yamlto 4.3.0 or later, then regenerate and commitpackage-lock.json.Potential paths:
js-yaml@^4.3.0for the dependency tree.Acceptance criteria
package-lock.jsonno longer resolvesjs-yaml@4.2.0.npm ci, JSON parse check,npx vsce package).