Change Request: Update js-yaml
envgap__eslint__eslintrc-234
01 / FAILURE SIGNATURE
As reported upstream
No identifying execution failure has been captured.
Not a benchmark task.
- The project already builds and runs before the fix, so there is nothing to repair.
02 / ENVIRONMENT RECIPE
- Base commit
94837a4ae3ceb0d592d880b38280c4059b50ef78- Manifest
package.json- Reproduce
Awaiting issue-specific recipe- Run under trace
Awaiting a meaningful runtime command
03 / ORIGINAL ISSUE TEXT
eslint/eslintrc #234 · read the original issue
### What problem do you want to solve? Hello, in our aduit we have a security vulnerability because of a outdated js-yaml. ``` ┌─────────────────────┬────────────────────────────────────────────────────────┐ │ moderate │ JS-YAML: Quadratic-complexity DoS in merge key │ │ │ handling via repeated aliases │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Package │ js-yaml │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Vulnerable versions │ >=4.0.0 <=4.1.1 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Patched versions │ >=4.2.0 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Paths │ .>eslint>@eslint/eslintrc>js-yaml │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ More info │ https://github.com/advisories/GHSA-h67p-54hq-rp68 │ └─────────────────────┴────────────────────────────────────────────────────────┘ ``` Would it be possible to update this package? Greetings Fynn Haupt ### What do you think is the correct solution? I guess to update the package. ### Participation - [ ] I am willing to submit a pull request for this change. ### AI acknowledgment - [x] I did not use AI to generate this issue report. - [ ] (If the above is not checked) I have reviewed the AI-generated content before submitting. ### Additional comments _No response_
04 / LABELS
Labels from the report text only; not yet run
No supported category has been assigned.
Label rules and the text that matched
[]