Problem
npm audit reports 2 vulnerabilities (1 high, 1 moderate), both from a single transitive package: js-yaml@4.1.1.
js-yaml 4.0.0 - 4.3.0
Severity: high
- JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
https://github.com/advisories/GHSA-h67p-54hq-rp68
- js-yaml: YAML merge-key chains can force quadratic CPU consumption
https://github.com/advisories/GHSA-52cp-r559-cp3m
- JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x)
— CVE-2026-59870 fix not backported
https://github.com/advisories/GHSA-5p4m-2wfm-xmqj
Exposure assessment
Dependency chain (npm ls js-yaml --all):
ownchart@1.7.9
├─┬ date-holidays@3.26.6
│ └── js-yaml@4.1.1 <-- runtime dependency
├─┬ eslint@8.57.1
│ ├─┬ @eslint/eslintrc@2.1.4
│ │ └── js-yaml@4.1.1 deduped <-- dev only
│ └── js-yaml@4.1.1 deduped <-- dev only
└─┬ vite-plugin-svgr@4.5.0
└─┬ @svgr/core@8.1.0
└─┬ cosmiconfig@8.3.6
└── js-yaml@4.1.1 deduped <-- build time only
Risk is low but not strictly zero. Two of the three paths (eslint, vite-plugin-svgr) are dev/build-time only and never reach the browser bundle. The third, date-holidays, is a runtime dependency — but it uses js-yaml to parse its own bundled holiday definition files, not user input. OwnChart is fully client-side and never parses user-supplied YAML, so there is no attacker-controlled path into the parser. The DoS would at worst be self-inflicted.
Worth fixing anyway to keep npm audit clean so real findings aren't lost in noise.
Proposed fix
npm audit fix reports a fix is available and should resolve this without a breaking change (js-yaml 4.3.0 → 4.4.x is a patch bump).
npm audit fix
npm audit # expect: 0 vulnerabilities
npm run ci:local # confirm nothing regressed
Bumping date-holidays (3.26.6 → 3.35.0, see #86) may also pull in a patched js-yaml on its own.
Acceptance criteria
Files
package-lock.jsonpackage.json (only if a direct dependency bump is needed)
Related: #86
Problem
npm auditreports 2 vulnerabilities (1 high, 1 moderate), both from a single transitive package:js-yaml@4.1.1.Exposure assessment
Dependency chain (
npm ls js-yaml --all):Risk is low but not strictly zero. Two of the three paths (eslint, vite-plugin-svgr) are dev/build-time only and never reach the browser bundle. The third,
date-holidays, is a runtime dependency — but it uses js-yaml to parse its own bundled holiday definition files, not user input. OwnChart is fully client-side and never parses user-supplied YAML, so there is no attacker-controlled path into the parser. The DoS would at worst be self-inflicted.Worth fixing anyway to keep
npm auditclean so real findings aren't lost in noise.Proposed fix
npm audit fixreports a fix is available and should resolve this without a breaking change (js-yaml 4.3.0 → 4.4.x is a patch bump).Bumping
date-holidays(3.26.6 → 3.35.0, see #86) may also pull in a patched js-yaml on its own.Acceptance criteria
npm auditreports 0 vulnerabilitiespackage-lock.jsoncommitted with the resolutionnpm run ci:localpassesdate-holidaysis the affected runtime path — spot-check the holiday settings and a chart with holidays enabled)Files
package-lock.jsonpackage.json(only if a direct dependency bump is needed)Related: #86