fix: pin js-yaml to exact version 4.1.1 - #335
Merged
Merged
Conversation
The caret range ^4.1.1 allows automatic minor and patch version upgrades on install, which can introduce unexpected behavior changes in CI and consumer environments. Pin to an exact version for deterministic installs. Co-Authored-By: Claude Code <noreply@anthropic.com>
This was referenced Apr 21, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Pins js-yaml to an exact version in the root package manifest to avoid unintended dependency drift at install time for YAML parsing behavior.
Changes:
- Change
js-yamldependency range from^4.1.1to4.1.1inpackage.json.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Collaborator
|
@xiaolai hey, while it might introduce changes, minor and patches are not breaking changes and allowing patches at runtime are the way to make sure that ongoing security changes enforced at runtime. I think that security wise the right thing is to get updated patches live. The lock file assure thise are being noticable when updates actually happened. |
Avi's preference: pin minor (block 4.2.x) but allow patches (4.1.x) so runtime security patches still flow in automatically. Tilde range is exactly that semantic in npm. Also addresses bot review: package-lock.json root entry now matches package.json (was still ^4.1.1 from before xiaolai's pin).
Collaborator
This was referenced Apr 23, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug
package.jsondeclaresjs-yamlwith a caret range:The caret (
^) permits automatic minor and patch version upgrades. Sincejs-yamlis a runtime dependency used to parse YAML in the plugin, an unintended version upgrade (e.g., 4.1.1 → 4.2.0 if one is published) could introduce breaking behavior changes across different install environments.Fix
Pin to the exact version already installed:
This ensures every install resolves to the same version that was tested, regardless of when or where
npm installis run.If
js-yamlneeds to be updated in the future, the version bump becomes an explicit, reviewable change rather than a silent automatic upgrade.