← All tasks
javascripteslint/eslintrc #234Not a task: already works

Change Request: Update js-yaml

envgap__eslint__eslintrc-234

01 / FAILURE SIGNATURE

As reported upstream

No identifying execution failure has been captured.
Not a benchmark task.
  • The project already builds and runs before the fix, so there is nothing to repair.

02 / ENVIRONMENT RECIPE

Base commit
94837a4ae3ceb0d592d880b38280c4059b50ef78
Manifest
package.json
Reproduce
Awaiting issue-specific recipe
Run under trace
Awaiting a meaningful runtime command

03 / ORIGINAL ISSUE TEXT

eslint/eslintrc #234 · read the original issue
### What problem do you want to solve?

Hello,
in our aduit we have a security vulnerability because of a outdated js-yaml.

```
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ JS-YAML: Quadratic-complexity DoS in merge key         │
│                     │ handling via repeated aliases                          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ js-yaml                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=4.0.0 <=4.1.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.2.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ .>eslint>@eslint/eslintrc>js-yaml                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-h67p-54hq-rp68      │
└─────────────────────┴────────────────────────────────────────────────────────┘
```

Would it be possible to update this package?

Greetings
Fynn Haupt

### What do you think is the correct solution?

I guess to update the package.

### Participation

- [ ] I am willing to submit a pull request for this change.

### AI acknowledgment

- [x] I did not use AI to generate this issue report.
- [ ] (If the above is not checked) I have reviewed the AI-generated content before submitting.

### Additional comments

_No response_
Continue on GitHub ↗

04 / LABELS

Labels from the report text only; not yet run

No supported category has been assigned.

Label rules and the text that matched
[]