From d2c848320edb14d180d8572f47096d5708389c10 Mon Sep 17 00:00:00 2001 From: Lucie Germain <116178070+lucie-germain@users.noreply.github.com> Date: Mon, 6 Jul 2026 12:14:03 +0200 Subject: [PATCH] [Security upgrade] bump js-yaml to 4.2.0 in root workspace (#34925) * [Security upgrade] bump js-yaml 4.1.1 -> 4.2.0 in root workspace GHSA-h67p-54hq-rp68, patched in 4.2.0. js-yaml 4.x is pulled at runtime via the patched referer-parser (web) plus many dev/build consumers. Bumped the existing scoped resolution referer-parser/js-yaml ^4.1.1 -> ^4.2.0 (security floor on the patched-parent path) and re-resolved all 4.x to 4.2.0 (yarn up -R). The js-yaml 3.x line (3.14.2) is a different major, unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) * Bump js-yaml range in referer-parser patch to ^4.2.0 for consistency The referer-parser/js-yaml resolution override forces js-yaml to 4.2.0, but the local patch still declared ^4.1.0. Align the patch's declared range with the resolution. Addresses Jakob's review comment on #34695 (discussion_r3440549168). Co-Authored-By: Claude Opus 4.8 (1M context) * Make patched-parent realignment a mandatory Type B step in yarn-security-update skill The patch-realignment instruction was a soft 'for consistency' parenthetical; a session reading the rule acted only on 'use a resolution' and dropped the patch edit, leaving the resolution at ^4.2.0 while the referer-parser patch still declared ^4.1.0 (PR #34925). Promote it to an explicit mandatory step. Co-Authored-By: Claude Opus 4.8 (1M context) * Fully resolve js-yaml to 4.2.0 and stop patching its range in referer-parser Add a scoped resolution for @istanbuljs/load-nyc-config/js-yaml so the last sub-4.2.0 instance (3.14.2, GHSA-h67p-54hq-rp68) is forced to 4.2.0 too; load-nyc-config uses js-yaml.load(), which is 4.x-compatible. Drop the js-yaml and mocha dependency edits from the referer-parser patch: editing a patched package's dependencies has no effect on resolution, so the scoped resolution is the entire fix. Update the yarn-security-update skill to match (patched parents route to Type B; do not edit the patch). Co-Authored-By: Claude Opus 4.8 (1M context) * Combine js-yaml resolutions into a single global override Replace the two scoped js-yaml resolutions (referer-parser/js-yaml and @istanbuljs/load-nyc-config/js-yaml) with one global "js-yaml": "^4.2.0". Every js-yaml consumer should reach the security floor and none needs an older major, so the global override is equivalent and tidier (reviewer request). Note the scoped-vs-global tradeoff in the yarn-security-update skill. Co-Authored-By: Claude Opus 4.8 (1M context) --------- Co-authored-by: Claude Opus 4.8 (1M context) GitOrigin-RevId: 1738cbc04f4cacbfb6880ba6f176a192aa4a03f7 --- .yarn/patches/referer-parser-npm-0.0.3.patch | 12 ------ package.json | 2 +- yarn.lock | 40 +++----------------- 3 files changed, 7 insertions(+), 47 deletions(-) diff --git a/.yarn/patches/referer-parser-npm-0.0.3.patch b/.yarn/patches/referer-parser-npm-0.0.3.patch index ecff8b17c7..5dfc8eae3d 100644 --- a/.yarn/patches/referer-parser-npm-0.0.3.patch +++ b/.yarn/patches/referer-parser-npm-0.0.3.patch @@ -9,18 +9,6 @@ diff --git a/package.json b/package.json "description": "library for extracting marketing attribution data (such as search terms) from referrer URLs", "main": "index.js", "scripts": { -@@ -15,9 +15,9 @@ - } - ], - "dependencies": { -- "js-yaml": "~2.1.0" -+ "js-yaml": "^4.1.0" - }, - "devDependencies": { -- "mocha": "~1.12.0" -+ "mocha": "~10.2.0" - } - } diff --git a/index.js b/index.js --- a/index.js +++ b/index.js diff --git a/package.json b/package.json index 3af1945b8c..513fab5f69 100644 --- a/package.json +++ b/package.json @@ -37,7 +37,7 @@ "@xmldom/xmldom": "0.8.13", "argparse/underscore": "1.13.8", "east/underscore": "1.13.8", - "referer-parser/js-yaml": "^4.1.1", + "js-yaml": "^4.2.0", "sandboxed-module": "patch:sandboxed-module@npm%3A2.0.4#~/.yarn/patches/sandboxed-module-npm-2.0.4-f8b45aacc9.patch", "request/tough-cookie": "5.1.2", "request/form-data": "2.5.6", diff --git a/yarn.lock b/yarn.lock index 0e3fed8a66..473ca231cc 100644 --- a/yarn.lock +++ b/yarn.lock @@ -13308,15 +13308,6 @@ __metadata: languageName: node linkType: hard -"argparse@npm:^1.0.7": - version: 1.0.10 - resolution: "argparse@npm:1.0.10" - dependencies: - sprintf-js: "npm:~1.0.2" - checksum: 10c0/b2972c5c23c63df66bca144dbc65d180efa74f25f8fd9b7d9a0a6c88ae839db32df3d54770dcb6460cf840d232b60695d1a6b1053f599d84e73f7437087712de - languageName: node - linkType: hard - "argparse@npm:^2.0.1": version: 2.0.1 resolution: "argparse@npm:2.0.1" @@ -22362,26 +22353,14 @@ __metadata: languageName: node linkType: hard -"js-yaml@npm:^3.13.1": - version: 3.14.2 - resolution: "js-yaml@npm:3.14.2" - dependencies: - argparse: "npm:^1.0.7" - esprima: "npm:^4.0.0" - bin: - js-yaml: bin/js-yaml.js - checksum: 10c0/3261f25912f5dd76605e5993d0a126c2b6c346311885d3c483706cd722efe34f697ea0331f654ce27c00a42b426e524518ec89d65ed02ea47df8ad26dcc8ce69 - languageName: node - linkType: hard - -"js-yaml@npm:^4.1.0, js-yaml@npm:^4.1.1": - version: 4.1.1 - resolution: "js-yaml@npm:4.1.1" +"js-yaml@npm:^4.2.0": + version: 4.2.0 + resolution: "js-yaml@npm:4.2.0" dependencies: argparse: "npm:^2.0.1" bin: js-yaml: bin/js-yaml.js - checksum: 10c0/561c7d7088c40a9bb53cc75becbfb1df6ae49b34b5e6e5a81744b14ae8667ec564ad2527709d1a6e7d5e5fa6d483aa0f373a50ad98d42fde368ec4a190d4fae7 + checksum: 10c0/1916456c118746603b067d74bbcbb0445d9a1d5e474ad4ae775e7b20525bed902e01d9d97dd0c81fcd8d4f596162309d0eb057f4aa38f3e9647f14075e9dea45 languageName: node linkType: hard @@ -29496,10 +29475,10 @@ __metadata: "referer-parser@patch:referer-parser@npm%3A0.0.3#~/.yarn/patches/referer-parser-npm-0.0.3.patch": version: 0.0.3 - resolution: "referer-parser@patch:referer-parser@npm%3A0.0.3#~/.yarn/patches/referer-parser-npm-0.0.3.patch::version=0.0.3&hash=3b17c1" + resolution: "referer-parser@patch:referer-parser@npm%3A0.0.3#~/.yarn/patches/referer-parser-npm-0.0.3.patch::version=0.0.3&hash=a5f138" dependencies: js-yaml: "npm:~2.1.0" - checksum: 10c0/e2ff496ff36c893bbc6e27579d041086f705a137f5bf9357bc71df9bba7e9144b0adcf81e8320bcbf5a49828daaabee945a34cc6ef86f148314d2cfb16341685 + checksum: 10c0/53f6eaa03feff6c2d61660a661423b7c1247d898c45d380b477d5a6048acd9c6bb6418532731fcca83c4bc7d575688ecc920a38abe16d330eeaa4862eba23267 languageName: node linkType: hard @@ -31355,13 +31334,6 @@ __metadata: languageName: node linkType: hard -"sprintf-js@npm:~1.0.2": - version: 1.0.3 - resolution: "sprintf-js@npm:1.0.3" - checksum: 10c0/ecadcfe4c771890140da5023d43e190b7566d9cf8b2d238600f31bec0fc653f328da4450eb04bd59a431771a8e9cc0e118f0aa3974b683a4981b4e07abc2a5bb - languageName: node - linkType: hard - "sprintf-kit@npm:^2.0.2": version: 2.0.2 resolution: "sprintf-kit@npm:2.0.2"