From 8f43eeb1b3d2b730467e29f6d146d3ecbb92969a Mon Sep 17 00:00:00 2001 From: Matt Amos Date: Mon, 14 Sep 2026 17:22:06 +0100 Subject: [PATCH] Bump js-yaml to 3.15.2 to clear GHSA-2883-xcg3-v3hh js-yaml 3.15.1 is affected by a high-severity advisory where maxTotalMergeKeys fails to limit CPU use for empty merge sources. It reaches us only as a dev-only transitive of ava, via supertap's js-yaml@^3.14.1. 3.15.2 is the patched release inside that range, so this is a plain in-range bump with no overrides. npm audit now reports 0 vulnerabilities. The demo workspace was already clean. Co-Authored-By: Claude Opus 5 (1M context) --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 59a8061..524dc91 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3498,9 +3498,9 @@ } }, "node_modules/js-yaml": { - "version": "3.15.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", - "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", + "version": "3.15.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz", + "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==", "dev": true, "license": "MIT", "dependencies": {