Skip to content

Commit 537e0bb

Browse files
authored
fix(security): bump js-yaml resolution to ^4.3.0 (GHSA-52cp-r559-cp3m) (#14888)
fix(security): bump js-yaml resolution to ^4.3.0 — resolves https://github.com/aws-amplify/amplify-js/security/dependabot/271 The root resolutions entry pinned js-yaml to 4.2.0, which is inside the vulnerable range of GHSA-52cp-r559-cp3m (YAML merge-key chains can force quadratic CPU consumption; affected >=4.0.0 <4.3.0). Bumping the resolution to ^4.3.0 forces every js-yaml specifier in yarn.lock (^3.13.1, ^3.6.1, ^4.1.0, ^4.1.1) to the patched 4.3.0.
1 parent dd5a429 commit 537e0bb

2 files changed

Lines changed: 5 additions & 5 deletions

File tree

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@
136136
"xml2js": "0.5.0",
137137
"**/form-data": "4.0.6",
138138
"qs": "^6.14.1",
139-
"js-yaml": "4.2.0",
139+
"js-yaml": "^4.3.0",
140140
"launch-editor": "^2.14.1",
141141
"serialize-javascript": "^7.0.5",
142142
"@tootallnate/once": "3.0.1",

yarn.lock

Lines changed: 4 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)