From 537e0bbc93997586622b6df99976ebbe777539ad Mon Sep 17 00:00:00 2001
From: Philipp Andreas Paul <phandpau@amazon.de>
Date: Mon, 27 Jul 2026 17:59:15 +0200
Subject: [PATCH] fix(security): bump js-yaml resolution to ^4.3.0
 (GHSA-52cp-r559-cp3m) (#14888)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fix(security): bump js-yaml resolution to ^4.3.0 — resolves https://github.com/aws-amplify/amplify-js/security/dependabot/271

The root resolutions entry pinned js-yaml to 4.2.0, which is inside the
vulnerable range of GHSA-52cp-r559-cp3m (YAML merge-key chains can force
quadratic CPU consumption; affected >=4.0.0 <4.3.0). Bumping the
resolution to ^4.3.0 forces every js-yaml specifier in yarn.lock
(^3.13.1, ^3.6.1, ^4.1.0, ^4.1.1) to the patched 4.3.0.
---
 package.json | 2 +-
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 3f1386b4aae..e3ccc8c2b79 100644
--- a/package.json
+++ b/package.json
@@ -136,7 +136,7 @@
 		"xml2js": "0.5.0",
 		"**/form-data": "4.0.6",
 		"qs": "^6.14.1",
-		"js-yaml": "4.2.0",
+		"js-yaml": "^4.3.0",
 		"launch-editor": "^2.14.1",
 		"serialize-javascript": "^7.0.5",
 		"@tootallnate/once": "3.0.1",
diff --git a/yarn.lock b/yarn.lock
index 57623a3be89..8baae97799d 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -9530,10 +9530,10 @@ js-cookie@^3.0.7:
   resolved "https://registry.yarnpkg.com/js-tokens/-/js-tokens-4.0.0.tgz#19203fb59991df98e3a287050d4647cdeaf32499"
   integrity sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==
 
-js-yaml@4.2.0, js-yaml@^3.13.1, js-yaml@^3.6.1, js-yaml@^4.1.0, js-yaml@^4.1.1:
-  version "4.2.0"
-  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.2.0.tgz#2bd9e85682dd91bd469afb809d816043b3d49524"
-  integrity sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==
+js-yaml@^3.13.1, js-yaml@^3.6.1, js-yaml@^4.1.0, js-yaml@^4.1.1, js-yaml@^4.3.0:
+  version "4.3.0"
+  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.0.tgz#d1900572a7f7cf0b5f540c83673e60bad3436592"
+  integrity sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==
   dependencies:
     argparse "^2.0.1"