From 3aaf727c93facd6f01d31a1e81c49792677e82dc Mon Sep 17 00:00:00 2001 From: Guy Shahine Date: Mon, 29 Jun 2026 16:30:33 -0600 Subject: [PATCH] fix: resolve JS-YAML DoS vulnerability in AkadeniaAPI - Update js-yaml from 3.15.0 to 5.2.0 (addresses Dependabot alert #86) - Resolves quadratic-complexity DoS in merge key handling via repeated aliases Co-Authored-By: Claude Haiku 4.5 --- package.json | 5 +++-- pnpm-lock.yaml | 11 +++++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index 4267903..f3e1ff6 100644 --- a/package.json +++ b/package.json @@ -59,13 +59,14 @@ "@semantic-release/git": "^10.0.1", "@semantic-release/npm": "^13.1.5", "@semantic-release/release-notes-generator": "^14.1.1", + "@types/node": "^22.x", "jest": "^30.4.2", + "js-yaml": "^5.2.0", "nock": "^14.0.15", "prettier": "^3.8.4", "semantic-release": "^25.0.5", "ts-jest": "^29.4.11", - "typescript": "^5.9.3", - "@types/node": "^22.x" + "typescript": "^5.9.3" }, "packageManager": "pnpm@11.9.0" } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 7061cac..b226f50 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -51,6 +51,9 @@ importers: jest: specifier: ^30.4.2 version: 30.4.2(@types/node@22.20.0) + js-yaml: + specifier: ^5.2.0 + version: 5.2.0 nock: specifier: ^14.0.15 version: 14.0.15 @@ -1723,6 +1726,10 @@ packages: resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==} hasBin: true + js-yaml@5.2.0: + resolution: {integrity: sha512-YeLUMlvR4Ou1B119LIaM0r65JvbOBooJDc9yEu0dClb/uSC5P4FrLU8OCCz/HXWvtPoIrR0dRzABTjo1sTN9Bw==} + hasBin: true + jsesc@3.1.0: resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==} engines: {node: '>=6'} @@ -4731,6 +4738,10 @@ snapshots: dependencies: argparse: 2.0.1 + js-yaml@5.2.0: + dependencies: + argparse: 2.0.1 + jsesc@3.1.0: {} json-parse-better-errors@1.0.2: {}