[rush] rush-lib bundles pnpm-sync-lib that pins vulnerable yaml@2.4.1

[faizanongit]

Summary

@microsoft/rush-lib depends on pnpm-sync-lib@0.3.3, which exact-pins yaml@2.4.1. That version is flagged by security scanners / Component Governance under GHSA-48c2-rrv3-qjmp — "yaml is vulnerable to Stack Overflow via deeply nested YAML collections" (Moderate; vulnerable >=2.0.0 <2.8.3, patched >=2.8.3).

Because this yaml is pulled into Rush's install-run bootstrap (common/temp/install-run/@microsoft+rush@<version>/), it cannot be remediated by any consumer-side Rush configuration (details below). It can only be fixed upstream.

The root pin is already tracked at tiktok/pnpm-sync#44, but that issue has been open since 2026-03-26 with no maintainer response, and pnpm-sync appears unmaintained (last commit ~10 months ago). Since @microsoft/rush-lib is the primary consumer of pnpm-sync-lib, raising it here so Rush can drive a resolution.

Dependency chain

yaml@2.4.1
  node_modules/yaml
    yaml@"2.4.1" from pnpm-sync-lib@0.3.3
      node_modules/pnpm-sync-lib
        pnpm-sync-lib@"0.3.3" from @microsoft/rush-lib@<version>
          @microsoft/rush-lib from @microsoft/rush@<version>

pnpm-sync-lib hard-codes "yaml": "2.4.1" (exact, not a range) in every published version up to and including the latest 0.3.3:
https://github.com/tiktok/pnpm-sync/blob/main/packages/pnpm-sync-lib/package.json

Confirmed on @microsoft/rush-lib@5.170.1 and @microsoft/rush-lib@5.175.0; the latest @microsoft/rush-lib@5.176.0 still declares "pnpm-sync-lib": "0.3.3".

[iclanton]

Pete Gonzalez (@octogonz) - can someone from your side look at fixing this upstream?

[faizanongit]

@octogonz - can someone from your side look at fixing this upstream?

PR tiktok/pnpm-sync#46 , waiting on Pete Gonzalez (@octogonz) review.

[octogonz]

Thanks for implementing this! I am out this week, will be back next week!