Skip to content

Commit 14dfe52

Browse files
committed
fix(appsec): force js-yaml resolution to >=4.3.1 for wasm-js-rewriter (GHSA-5p4m-2wfm-xmqj)
@datadog/wasm-js-rewriter@5.0.2 only loosened its own js-yaml range to ^4.1.1, which still permits resolving the vulnerable 4.1.x-4.3.0 range. Add a yarn resolution scoped to that dependency edge so it resolves to the patched 4.3.1 instead.
1 parent 4e9f842 commit 14dfe52

2 files changed

Lines changed: 7 additions & 4 deletions

File tree

package.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -253,5 +253,8 @@
253253
"workerpool": "^10.0.3",
254254
"yaml": "^2.9.0",
255255
"yarn-deduplicate": "^6.0.2"
256+
},
257+
"resolutions": {
258+
"@datadog/wasm-js-rewriter/js-yaml": "^4.3.1"
256259
}
257260
}

yarn.lock

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2854,10 +2854,10 @@ js-yaml@^3.13.1:
28542854
argparse "^1.0.7"
28552855
esprima "^4.0.0"
28562856

2857-
js-yaml@^4.1.0, js-yaml@^4.1.1:
2858-
version "4.1.1"
2859-
resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.1.1.tgz#854c292467705b699476e1a2decc0c8a3458806b"
2860-
integrity sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==
2857+
js-yaml@^4.1.0, js-yaml@^4.1.1, js-yaml@^4.3.1:
2858+
version "4.3.1"
2859+
resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.1.tgz#01216c001d67f48e2cd560d708c7af21090a3848"
2860+
integrity sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==
28612861
dependencies:
28622862
argparse "^2.0.1"
28632863

0 commit comments

Comments
 (0)