Skip to content

chore: update js-yaml to patched release#2543

Merged
jakehobbs merged 1 commit into
mainfrom
jake/update-js-yaml-4-2-0
Jun 17, 2026
Merged

chore: update js-yaml to patched release#2543
jakehobbs merged 1 commit into
mainfrom
jake/update-js-yaml-4-2-0

Conversation

@jakehobbs

@jakehobbs jakehobbs commented Jun 17, 2026

Copy link
Copy Markdown
Collaborator

Updates the root js-yaml dependency to ^4.2.0 and regenerates the lockfile so the repo-level TypeDoc YAML generator resolves to the patched release.
The lockfile diff has been narrowed back to js-yaml only; unrelated axios/tmp/yaml churn was removed.
Validation: pnpm install --lockfile-only, pnpm install --frozen-lockfile --ignore-scripts, and node -p "require('js-yaml/package.json').version".
Note: full pnpm audit still reports separate transitive Lerna/Nx js-yaml paths that require broader tooling changes.

Pull Request Checklist

  • Did you add new tests and confirm existing tests pass? (pnpm test) - Not run; dependency-only change.
  • Did you update relevant docs? (docs are found in the docs folder, and guidelines for updating/adding docs can be found in the contribution guide) - Not applicable.
  • Do your commits follow the Conventional Commits standard?
  • Does your PR title also follow the Conventional Commits standard?
  • If you have a breaking change, is it correctly reflected in your commit message? (e.g. feat!: breaking change) - No breaking change.
  • Did you run lint (pnpm run lint:check) and fix any issues? (pnpm run lint:write) - Not run; dependency-only change.
  • Did you follow the contribution guidelines?

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request updates the workspace’s YAML parsing dependency to a patched js-yaml release and forces Lerna to resolve js-yaml to that patched version via a scoped pnpm override, aiming to secure usage in scripts/generate-typedoc-yaml.ts without a Lerna major bump or pnpm patches.

Changes:

  • Bump root js-yaml devDependency from ^4.1.1 to ^4.2.0.
  • Add pnpm.overrides["lerna>js-yaml"] = ^4.2.0 to ensure Lerna’s js-yaml resolution is patched.
  • Update pnpm-lock.yaml to reflect the new override and resulting dependency graph changes.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File Description
package.json Updates js-yaml and adds a scoped pnpm override for lerna>js-yaml.
pnpm-lock.yaml Records the new override and updated resolved versions in the lockfile.
Files not reviewed (1)
  • pnpm-lock.yaml: Generated file

Comment thread package.json
Comment thread pnpm-lock.yaml Outdated
Resolve the direct js-yaml advisory by moving the repo-level YAML generator dependency to the patched release.

Co-Authored-By: Codex <noreply@openai.com>
@jakehobbs jakehobbs force-pushed the jake/update-js-yaml-4-2-0 branch from a1beffa to 24ab13b Compare June 17, 2026 19:51
@jakehobbs jakehobbs merged commit 017b640 into main Jun 17, 2026
9 checks passed
@jakehobbs jakehobbs deleted the jake/update-js-yaml-4-2-0 branch June 17, 2026 20:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants