chore(deps): upgrade js-yaml to 5.2 and drop @types/js-yaml

Author: Medformatik

.changeset/upgrade-js-yaml-5.md

@@ -0,0 +1,5 @@
+---
+"@openmapx/core": patch
+---
+
+Upgrade js-yaml from 4.x to 5.2.x. js-yaml 5 is a dual CJS/ESM package that addresses the merge-key DoS (GHSA-h67p-54hq-rp68) structurally and ships its own TypeScript types (the separate `@types/js-yaml` dev dependency is dropped). The Docker compose renderer's output is functionally identical; only cosmetic scalar quoting differs in one edge case (a bare `-c` argument is no longer single-quoted, and parses back to the same string).

packages/core/package.json

@@ -70,10 +70,9 @@
     "@turf/helpers": "^7.3.5",
     "@turf/nearest-point-on-line": "^7.3.5",
     "@types/geojson": "^7946.0.16",
-    "@types/js-yaml": "^4.0.9",
     "@types/tz-lookup": "^6.1.2",
     "better-auth": "^1.6.18",
-    "js-yaml": "^4.1.2",
+    "js-yaml": "^5.2.1",
     "opening_hours": "^3.13.0",
     "react": "19.2.7",
     "tz-lookup": "^6.1.25",

packages/integration-framework/package.json

@@ -43,7 +43,6 @@
     "@openmapx/poi-source-registry": "workspace:^",
     "impit": "^0.14.1",
     "intl-messageformat": "^11.2.8",
-    "js-yaml": "^4.1.2",
     "zod": "^4.4.3"
   },
   "peerDependencies": {
@@ -61,7 +60,6 @@
   },
   "devDependencies": {
     "@types/geojson": "^7946.0.16",
-    "@types/js-yaml": "^4.0.9",
     "@types/node": "^24.13.2",
     "@types/react": "^19.2.17",
     "esbuild": "^0.28.0",

pnpm-lock.yaml

@@ -52,13 +52,16 @@ overrides:
   "fast-uri": ">=3.1.2"
   "kysely": ">=0.28.17"
   "fast-xml-builder": ">=1.1.7"
-  # >=4.1.2 closes GHSA-h67p-54hq-rp68 (quadratic-complexity DoS via merge-key
-  # aliases). Pulled in transitively by @changesets/cli.
-  "js-yaml": "^4.1.2"
-  # read-yaml-file@1.1.0 (a @changesets/cli transitive) calls js-yaml's
-  # `safeLoad`, removed in js-yaml 4 — so the js-yaml override above crashes
-  # `changeset status`. 2.1.0 is the newest CJS release that uses js-yaml 4's
-  # `load` API (3.0.0 is ESM-only and breaks the CJS changesets requires).
+  # js-yaml 5.2.x is a dual CJS/ESM package that addresses the merge-key DoS
+  # (GHSA-h67p-54hq-rp68) structurally: load() defaults to CORE_SCHEMA (no
+  # `!!merge`), plus the maxTotalMergeKeys/maxAliases caps added in 5.2.0.
+  # Pinned to keep one version workspace-wide — our compose-renderer and the
+  # @changesets/cli transitive both resolve to 5.2.x.
+  "js-yaml": "^5.2.1"
+  # read-yaml-file@2.1.0 is a @changesets/cli transitive that does a CJS
+  # `require("js-yaml").load(...)`. It works with js-yaml 5's `require` entry
+  # (5.x is a dual package) and its `load`. 3.0.0 is ESM-only and breaks the
+  # CJS changesets requires, so stay on 2.1.0.
   "read-yaml-file": "^2.1.0"
   # ^7.28.0 closes the 7 advisories pnpm audit reports against undici 7.27.2,
   # incl. GHSA-vmh5-mc38-953g, GHSA-vxpw-j846-p89q and GHSA-hm92-r4w5-c3mj