GHSA-72gw-mp4g-v24j / CVE-2026-5079 — DoS via deeply nested field names,
patched in 2.2.0. multer is a direct dep of web and clsi (file uploads).
- bump multer to 2.2.0 in services/web and services/clsi
- re-target the Overleaf local patch (attach files with no filename as
'undefined' instead of skipping) from 2.1.1 to 2.2.0, kept as a scoped
root resolution to match the repo's patch convention
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 0d10137b521ebaacee71fc41adba32c4530a4041
* [Security upgrade] bump js-yaml 4.1.1 -> 4.2.0 in root workspace
GHSA-h67p-54hq-rp68, patched in 4.2.0. js-yaml 4.x is pulled at runtime via
the patched referer-parser (web) plus many dev/build consumers.
Bumped the existing scoped resolution referer-parser/js-yaml ^4.1.1 -> ^4.2.0
(security floor on the patched-parent path) and re-resolved all 4.x to 4.2.0
(yarn up -R). The js-yaml 3.x line (3.14.2) is a different major, unaffected.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Bump js-yaml range in referer-parser patch to ^4.2.0 for consistency
The referer-parser/js-yaml resolution override forces js-yaml to 4.2.0,
but the local patch still declared ^4.1.0. Align the patch's declared
range with the resolution. Addresses Jakob's review comment on #34695
(discussion_r3440549168).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Make patched-parent realignment a mandatory Type B step in yarn-security-update skill
The patch-realignment instruction was a soft 'for consistency' parenthetical;
a session reading the rule acted only on 'use a resolution' and dropped the
patch edit, leaving the resolution at ^4.2.0 while the referer-parser patch
still declared ^4.1.0 (PR #34925). Promote it to an explicit mandatory step.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Fully resolve js-yaml to 4.2.0 and stop patching its range in referer-parser
Add a scoped resolution for @istanbuljs/load-nyc-config/js-yaml so the last
sub-4.2.0 instance (3.14.2, GHSA-h67p-54hq-rp68) is forced to 4.2.0 too;
load-nyc-config uses js-yaml.load(), which is 4.x-compatible.
Drop the js-yaml and mocha dependency edits from the referer-parser patch:
editing a patched package's dependencies has no effect on resolution, so the
scoped resolution is the entire fix. Update the yarn-security-update skill to
match (patched parents route to Type B; do not edit the patch).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Combine js-yaml resolutions into a single global override
Replace the two scoped js-yaml resolutions (referer-parser/js-yaml and
@istanbuljs/load-nyc-config/js-yaml) with one global "js-yaml": "^4.2.0". Every
js-yaml consumer should reach the security floor and none needs an older major,
so the global override is equivalent and tidier (reviewer request).
Note the scoped-vs-global tradeoff in the yarn-security-update skill.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 1738cbc04f4cacbfb6880ba6f176a192aa4a03f7
Migrates the Overleaf monorepo package manager from npm (v11) to Yarn 4 (v4.9.1) using node-modules linker mode.
GitOrigin-RevId: 50d32ab01955c15e29679eff9e9e9cfb897fab2d
yu-i-i