fix: address high CVEs in js-yaml and nanoid - #34
Merged
Merged
Conversation
- js-yaml >=4.0.0 <4.3.1 (GHSA-5p4m-2wfm-xmqj, high): quadratic CPU consumption resolving !!omap. Reached from both apps/dashboard and packages/cli. Bumped the declared dependency in each, not just the override, because overrides don't apply to consumers of the published @easydocs/cli and @easydocs/dashboard. - nanoid <3.3.18 (GHSA-2v37-7h3g-55p8, high): custom generators loop indefinitely when size is zero. Only reached via next > postcss, which pins ^3.3.x, so the override stays on the 3.x line. `pnpm audit --audit-level=high --prod` now exits 0, unblocking `pnpm release`. Two low-severity advisories remain (@babel/core, body-parser), both below the release gate's threshold. Claude-Session: https://claude.ai/code/session_01GrfumUQ4vFUAgsFYwzDyK8
RubenGlez
added a commit
that referenced
this pull request
Aug 14, 2026
Folds in the js-yaml and nanoid CVE patches from #34, which landed without their own entry, under a Security heading. Claude-Session: https://claude.ai/code/session_01GrfumUQ4vFUAgsFYwzDyK8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks
pnpm release, whose gate ispnpm audit --audit-level=high --prod.!!omapresolutionapps/dashboard > js-yaml,packages/cli > js-yaml>=4.3.1apps/dashboard > next > postcss > nanoid>=3.3.18Notes
js-yaml is bumped in the manifests, not only the override. It's a direct dependency of
@easydocs/cliand@easydocs/dashboard, and overrides apply only inside this repo — consumers installing the published packages would still resolve the vulnerable range. Both manifests now declare^4.3.1; the override moved from^4.1.1to^4.3.1to match.nanoid stays on the 3.x line. It's only reached transitively through
next > postcss, and postcss pins^3.3.x, so an override to 5.x would break resolution.Both patched versions clear the repo's
minimumReleaseAge: 1440(js-yaml 4.3.1 published 2026-07-31, nanoid 3.3.18 on 2026-08-07), so nominimumReleaseAgeExcludeentry is needed.Verification
pnpm audit --audit-level=high --prodexits 0. Two low-severity advisories remain (@babel/core,body-parser), both under the gate's threshold.build,lint,typecheckgreen; 212 tests pass.diffon two YAML specs correctly reports the breaking change and exits 3 (parse path), andexport --yamlemits valid YAML (dump path).Not included
No CHANGELOG entry, matching the convention of the previous CVE sweep (1becbb5), and to keep this branch conflict-free against #33. The js-yaml bump is user-facing for the published CLI, so it's worth a
### Securityline whenever the next version is cut.Independent of #33 — both touch
pnpm-lock.yaml, so whichever merges second needs a lockfile regeneration.https://claude.ai/code/session_01GrfumUQ4vFUAgsFYwzDyK8