Skip to content

fix: js-yaml の DoS 脆弱性を 5.2.1 へ更新 - #164

Merged
ara-ta3 merged 1 commit into
mainfrom
devin/1784596024-fix-js-yaml-vuln
Jul 21, 2026
Merged

fix: js-yaml の DoS 脆弱性を 5.2.1 へ更新#164
ara-ta3 merged 1 commit into
mainfrom
devin/1784596024-fix-js-yaml-vuln

Conversation

@devin-ai-integration

Copy link
Copy Markdown
Contributor

Summary

Dependabot が報告した js-yaml の脆弱性 (Quadratic-complexity O(n^2) DoS via !!omap tag in YAML11_SCHEMA、medium、対象範囲 >=5.0.0, <=5.2.0) を修正。

pnpm-workspace.yaml の override を既存の js-yaml@<=4.1.1: '>=4.2.0' から js-yaml@<5.2.1: '>=5.2.1' に変更し、pnpm-lock.yaml 上の js-yaml を全て 5.2.0 → 5.2.1 (patched, 現行 latest) に更新。

依存関係のみの変更で、ソースコードへの影響なし。

Link to Devin session: https://app.devin.ai/sessions/f4612dbb53c6488ab661c530bca75c3c
Requested by: @ara-ta3

Co-Authored-By: ara-ta3 <2089153+ara-ta3@users.noreply.github.com>
@ara-ta3 ara-ta3 self-assigned this Jul 21, 2026
@ara-ta3
ara-ta3 self-requested a review July 21, 2026 01:07
@devin-ai-integration

Copy link
Copy Markdown
Contributor Author

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment, CI, and merge conflict monitoring

@ara-ta3
ara-ta3 merged commit b38d17e into main Jul 21, 2026
1 check passed
@ara-ta3
ara-ta3 deleted the devin/1784596024-fix-js-yaml-vuln branch July 21, 2026 10:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant