chore(deps): override transitive js-yaml onto the patched 4.x line - #35
Merged
Conversation
A 2026-07-02 advisory flags js-yaml >=4.0.0 <=4.1.1; the 4.x line is patched from 4.2.0. The dependency is dev-graph only (redocly inside openapi-typescript; this package ships zero runtime dependencies), and @redocly/openapi-core hard-pins js-yaml to exactly 4.1.1, so Dependabot cannot apply the fix and fails on every scan. The pnpm override moves to the patched 4.x line, which keeps the js-yaml 4 API surface Redocly's vendored shim requires (the 5.x major removes the types namespace and crashes generate-types; verified and rejected). Verified by regenerating the full pipeline with byte-identical output and the complete test suite.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a pnpm override pinning transitive
js-yamlto^4.2.0(resolves to4.3.0), moving it off the vulnerable4.1.1.Why
A security advisory published 2026-07-02 flags
js-yaml >=4.0.0 <=4.1.1. In this repo js-yaml is transitive-only, dev/codegen graph exclusively; this package ships zero runtime dependencies. The chain is:Because
@redocly/openapi-corehard-pins js-yaml to4.1.1, Dependabot cannot move it and its security job fails on every scan (e.g. run 28606205321). The4.xline is patched from4.2.0, so the override moves to^4.2.0(resolves to4.3.0), which is outside the advisory's affected range.Why not the 5.x latest
A prior attempt overrode to
5.2.1and was tested and rejected. Redocly's vendored CJS shim (@redocly/openapi-core/lib/js-yaml/index.js) reads the js-yamltypesnamespace that the 5.x major removed, which crashesgenerate-types. Staying on the patched 4.x line keeps the js-yaml 4 API surface the shim requires while clearing the advisory.Verification
pnpm-lock.yamldiff is js-yaml-only churn: override line, resolution4.1.1 -> 4.3.0, the@redocly/openapi-coreedge, and the snapshot. Nojs-yaml@4.1.1entry remains.fix-specs,generate-api-servers,generate-types,generate-sdk,lint:fix) runs clean with byte-identical output:git statusshows onlypackage.jsonandpnpm-lock.yamlmodified, zero drift inspecs/fixed,src/**, orscripts/api-surface.yaml. Sync classification: benign.generate-types(the stage the 5.x attempt crashed on) runs clean on the 4.x line.pnpm test(443 pass),pnpm test:fuzz(12 pass),pnpm lint,pnpm typecheck,pnpm typecheck:test,pnpm build.