Context
A 2026-07-02 advisory flags js-yaml >=4.0.0 <=4.1.1. The dependency is dev-graph only (this package ships zero runtime dependencies): openapi-typescript -> @redocly/openapi-core@1.34.11, which hard-pins js-yaml to exactly 4.1.1, so Dependabot's security job could not apply a fix (see run 28606205321). PR #35 added a pnpm override forcing js-yaml: ^4.2.0 (resolves 4.3.0, the patched 4.x line).
The 5.x major was tested and rejected: Redocly's vendored CJS shim (@redocly/openapi-core/lib/js-yaml/index.js) reads the js-yaml 4 types namespace that 5.x removed, crashing generate-types. Do not retry 5.x until Redocly ships a compatible shim.
Done means
- @redocly/openapi-core (via openapi-typescript) resolves a js-yaml version that is not advisory-affected on its own (their latest already declares
^4.2.0, so a routine openapi-typescript bump may get there).
- Delete the
js-yaml entry from pnpm.overrides in package.json, run pnpm install, then the full offline pipeline (fix-specs, generate-api-servers, generate-types, generate-sdk, lint:fix) with zero generated-output drift, plus the full test suite.
- Dependabot security scans stay quiet.
Context
A 2026-07-02 advisory flags js-yaml >=4.0.0 <=4.1.1. The dependency is dev-graph only (this package ships zero runtime dependencies): openapi-typescript -> @redocly/openapi-core@1.34.11, which hard-pins js-yaml to exactly 4.1.1, so Dependabot's security job could not apply a fix (see run 28606205321). PR #35 added a pnpm override forcing
js-yaml: ^4.2.0(resolves 4.3.0, the patched 4.x line).The 5.x major was tested and rejected: Redocly's vendored CJS shim (
@redocly/openapi-core/lib/js-yaml/index.js) reads the js-yaml 4typesnamespace that 5.x removed, crashing generate-types. Do not retry 5.x until Redocly ships a compatible shim.Done means
^4.2.0, so a routine openapi-typescript bump may get there).js-yamlentry frompnpm.overridesin package.json, runpnpm install, then the full offline pipeline (fix-specs, generate-api-servers, generate-types, generate-sdk, lint:fix) with zero generated-output drift, plus the full test suite.