chore: bump tmp + js-yaml to patched versions#1101
Merged
Conversation
Closes Dependabot alerts 201 (tmp 0.2.6 → 0.2.7, high) and 205 (js-yaml unpinned → 4.2.0, medium). The remaining alerts (esbuild, @opentelemetry/core, protobufjs, vite) target patch versions still inside the 7-day minimumReleaseAge quarantine and will be addressed in a follow-up PR once eligible (earliest 2026-06-18, latest 2026-06-22). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
despock
requested review from
hemalshah-gradientedge and
jameswiltshire
as code owners
June 16, 2026 13:19
despock
added a commit
that referenced
this pull request
Jun 16, 2026
…the js-yaml 4 override The js-yaml: 4.2.0 override added in #1101 removes yaml.safeLoad. The @changesets/cli toolchain pulls read-yaml-file@1.1.0 transitively, which still calls safeLoad — so the changeset-release workflow blows up with 'Function yaml.safeLoad is removed in js-yaml 4' immediately after any merge that contains a changeset. read-yaml-file@2.1.0 is the first version that switched to yaml.load and keeps the v1 default-export shape that @manypkg/get-packages@1.1.3 calls into. v3.0.0 ships a named-export shape that breaks that consumer. Pinned exactly, no caret.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tmpoverride from0.2.6→0.2.7(closes Dependabot alert build(deps-dev): bump @typescript-eslint/parser from 5.33.1 to 5.35.1 #201, high — type-confusion path traversal).js-yaml: 4.2.0override (closes Dependabot alert build(deps): bump aws-sdk from 2.1199.0 to 2.1209.0 #205, medium — quadratic-complexity DoS via merge keys).pnpm-workspace.yaml#overridesto match the existing convention. Nopackage.jsonchanges; lockfile re-resolved.Remaining alerts (deferred)
The other 10 alerts target patched versions that are still inside the
minimumReleaseAge: 10080(7-day) quarantine. A follow-up PR will land them once eligible:Keeping the 7-day quarantine intact deliberately — it's there to mitigate supply-chain attacks on freshly-published packages, and these CVEs (esbuild RCE is Deno + custom registry; vite is dev-server-only on Windows; protobufjs high is JSON DoS on attacker input) are not exploitable on CI or shipped artifacts in the gap.