Commit 537e0bb
authored
fix(security): bump js-yaml resolution to ^4.3.0 (GHSA-52cp-r559-cp3m) (#14888)
fix(security): bump js-yaml resolution to ^4.3.0 — resolves https://github.com/aws-amplify/amplify-js/security/dependabot/271
The root resolutions entry pinned js-yaml to 4.2.0, which is inside the
vulnerable range of GHSA-52cp-r559-cp3m (YAML merge-key chains can force
quadratic CPU consumption; affected >=4.0.0 <4.3.0). Bumping the
resolution to ^4.3.0 forces every js-yaml specifier in yarn.lock
(^3.13.1, ^3.6.1, ^4.1.0, ^4.1.1) to the patched 4.3.0.1 parent dd5a429 commit 537e0bb
2 files changed
Lines changed: 5 additions & 5 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
136 | 136 | | |
137 | 137 | | |
138 | 138 | | |
139 | | - | |
| 139 | + | |
140 | 140 | | |
141 | 141 | | |
142 | 142 | | |
| |||
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments