update js-yaml to 4.1.x #56
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
resolves #54 This allows js-yaml 4.1.1 to be used, to avoid [CVE-2025-64718][]. [CVE-2025-64718]: https://www.cve.org/CVERecord?id=CVE-2025-64718
alumni
reviewed
Dec 3, 2025
Comment on lines
+20
to
22
| "js-yaml": "4.1.x", | ||
| "ports": "1.1.x", | ||
| "underscore": "1.12.x" |
There was a problem hiding this comment.
Would be great to have more flexibility:
Suggested change
| "js-yaml": "4.1.x", | |
| "ports": "1.1.x", | |
| "underscore": "1.12.x" | |
| "js-yaml": "^4.1.1", | |
| "ports": "^1.1.0", | |
| "underscore": "^1.13.7" |
ports hasn't been updated in 12 years, underscore@1.12.1 is 5 years old
At least for underscore something can be done, 1.13.7 is 16 months old, in 2 months it will also start triggering security warnings, but at least it will be easier to justify them.
|
Can this please be merged ASAP? We need this fix to address that CVE. Thanks! |
Member
Author
|
I'll eventually get to this, but it's on my back burner - I have no skin in this game. We'll have to find a new maintainer if there end up being frequent dependency updates ... because I have no time to deal with this. Presumably anyone willing to help maintain this would need to become a member of this org. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
resolves #54
This allows js-yaml 4.1.1 to be used, to avoid CVE-2025-64718.