From 55f326c9fec047c26faa1e48b971a1ae96259435 Mon Sep 17 00:00:00 2001 From: Tyler Jeong Date: Thu, 20 Aug 2026 15:21:40 +0900 Subject: [PATCH] Bump js-yaml 4.3.0 -> 4.3.1 to fix quadratic-time !!omap DoS Lockfile-only remediation; package.json is unchanged since the fix is an in-range transitive bump (cosmiconfig requires js-yaml ^4.1.0): - js-yaml 4.3.0 -> 4.3.1 High GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 Quadratic CPU consumption in `!!omap` resolution: a large omap sequence triggers a linear duplicate-key scan per element, blocking the event loop (DoS). dev-only, via vite-plugin-svgr -> @svgr/core -> cosmiconfig. Resolves SECURE-4465 / CLNP-8804. Co-Authored-By: Claude Opus 4.8 (1M context) --- discord-clone/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/discord-clone/package-lock.json b/discord-clone/package-lock.json index 0e0bcf9..ab64a7b 100644 --- a/discord-clone/package-lock.json +++ b/discord-clone/package-lock.json @@ -1873,9 +1873,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "dev": true, "funding": [ {