diff --git a/apps/api-documenter/package.json b/apps/api-documenter/package.json index 9779287bdf..2e3869f94e 100644 --- a/apps/api-documenter/package.json +++ b/apps/api-documenter/package.json @@ -53,7 +53,7 @@ "@rushstack/node-core-library": "workspace:*", "@rushstack/terminal": "workspace:*", "@rushstack/ts-command-line": "workspace:*", - "js-yaml": "~4.1.0", + "js-yaml": "~4.3.2", "resolve": "~1.22.1" }, "devDependencies": { diff --git a/apps/lockfile-explorer/package.json b/apps/lockfile-explorer/package.json index d37582a325..8aed402638 100644 --- a/apps/lockfile-explorer/package.json +++ b/apps/lockfile-explorer/package.json @@ -72,7 +72,7 @@ "@rushstack/ts-command-line": "workspace:*", "cors": "~2.8.5", "express": "4.21.1", - "js-yaml": "~4.1.0", + "js-yaml": "~4.3.2", "semver": "~7.7.4" }, "exports": { diff --git a/common/changes/@microsoft/api-documenter/update-js-yaml-security_2026-09-22-17-52.json b/common/changes/@microsoft/api-documenter/update-js-yaml-security_2026-09-22-17-52.json new file mode 100644 index 0000000000..12f1355683 --- /dev/null +++ b/common/changes/@microsoft/api-documenter/update-js-yaml-security_2026-09-22-17-52.json @@ -0,0 +1,10 @@ +{ + "changes": [ + { + "comment": "Update js-yaml dependency to ~4.3.2 to address security advisories for CPU consumption with certain inputs.", + "type": "patch", + "packageName": "@microsoft/api-documenter" + } + ], + "packageName": "@microsoft/api-documenter" +} diff --git a/common/changes/@microsoft/rush/update-js-yaml-security_2026-09-22-17-52.json b/common/changes/@microsoft/rush/update-js-yaml-security_2026-09-22-17-52.json new file mode 100644 index 0000000000..02606adc96 --- /dev/null +++ b/common/changes/@microsoft/rush/update-js-yaml-security_2026-09-22-17-52.json @@ -0,0 +1,10 @@ +{ + "changes": [ + { + "comment": "Update js-yaml dependency to ~4.3.2 to address security advisories for CPU consumption with certain inputs.", + "type": "patch", + "packageName": "@microsoft/rush" + } + ], + "packageName": "@microsoft/rush" +} diff --git a/common/changes/@rushstack/lockfile-explorer/update-js-yaml-security_2026-09-22-17-52.json b/common/changes/@rushstack/lockfile-explorer/update-js-yaml-security_2026-09-22-17-52.json new file mode 100644 index 0000000000..65919600b7 --- /dev/null +++ b/common/changes/@rushstack/lockfile-explorer/update-js-yaml-security_2026-09-22-17-52.json @@ -0,0 +1,10 @@ +{ + "changes": [ + { + "comment": "Update js-yaml dependency to ~4.3.2 to address security advisories for CPU consumption with certain inputs.", + "type": "patch", + "packageName": "@rushstack/lockfile-explorer" + } + ], + "packageName": "@rushstack/lockfile-explorer" +} diff --git a/common/config/subspaces/default/pnpm-lock.yaml b/common/config/subspaces/default/pnpm-lock.yaml index 3c8af9d4de..9aa6914337 100644 --- a/common/config/subspaces/default/pnpm-lock.yaml +++ b/common/config/subspaces/default/pnpm-lock.yaml @@ -37,8 +37,8 @@ importers: specifier: workspace:* version: link:../../libraries/ts-command-line js-yaml: - specifier: ~4.1.0 - version: 4.1.1 + specifier: ~4.3.2 + version: 4.3.2 resolve: specifier: ~1.22.1 version: 1.22.11 @@ -221,8 +221,8 @@ importers: specifier: 4.21.1 version: 4.21.1 js-yaml: - specifier: ~4.1.0 - version: 4.1.1 + specifier: ~4.3.2 + version: 4.3.2 semver: specifier: ~7.7.4 version: 7.7.4 @@ -4251,8 +4251,8 @@ importers: specifier: ~5.1.6 version: 5.1.9 js-yaml: - specifier: ~4.1.0 - version: 4.1.1 + specifier: ~4.3.2 + version: 4.3.2 npm-package-arg: specifier: ~6.1.0 version: 6.1.1 @@ -4677,8 +4677,8 @@ importers: specifier: workspace:* version: link:../../libraries/node-core-library js-yaml: - specifier: ~4.1.0 - version: 4.1.1 + specifier: ~4.3.2 + version: 4.3.2 devDependencies: '@rushstack/heft': specifier: workspace:* @@ -15148,8 +15148,8 @@ packages: resolution: {integrity: sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==} hasBin: true - js-yaml@4.1.1: - resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==} + js-yaml@4.3.2: + resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==} hasBin: true jscodeshift@0.13.1: @@ -19326,7 +19326,7 @@ snapshots: dependencies: '@jsdevtools/ono': 7.1.3 '@types/json-schema': 7.0.15 - js-yaml: 4.1.1 + js-yaml: 4.3.2 '@asamuzakjp/css-color@3.2.0': dependencies: @@ -21528,7 +21528,7 @@ snapshots: globals: 13.24.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.1.1 + js-yaml: 4.3.2 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -21542,7 +21542,7 @@ snapshots: globals: 13.24.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.1.1 + js-yaml: 4.3.2 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -21556,7 +21556,7 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.1.1 + js-yaml: 4.3.2 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -25194,7 +25194,7 @@ snapshots: express: 4.21.1 fs-extra: 9.1.0 immer: 9.0.21 - js-yaml: 4.1.1 + js-yaml: 4.3.2 kysely: 0.21.6 kysely-codegen: 0.6.2(kysely@0.21.6) kysely-data-api: 0.1.4(aws-sdk@2.1693.0)(kysely@0.21.6) @@ -31063,7 +31063,7 @@ snapshots: imurmurhash: 0.1.4 is-glob: 4.0.3 js-sdsl: 4.4.2 - js-yaml: 4.1.1 + js-yaml: 4.3.2 json-stable-stringify-without-jsonify: 1.0.1 levn: 0.4.1 lodash.merge: 4.6.2 @@ -31108,7 +31108,7 @@ snapshots: imurmurhash: 0.1.4 is-glob: 4.0.3 is-path-inside: 3.0.3 - js-yaml: 4.1.1 + js-yaml: 4.3.2 json-stable-stringify-without-jsonify: 1.0.1 levn: 0.4.1 lodash.merge: 4.6.2 @@ -31146,7 +31146,7 @@ snapshots: import-fresh: 3.3.1 imurmurhash: 0.1.4 is-glob: 4.0.3 - js-yaml: 4.1.1 + js-yaml: 4.3.2 json-stable-stringify-without-jsonify: 1.0.1 levn: 0.4.1 lodash.merge: 4.6.2 @@ -33774,7 +33774,7 @@ snapshots: argparse: 1.0.10 esprima: 4.0.1 - js-yaml@4.1.1: + js-yaml@4.3.2: dependencies: argparse: 2.0.1 @@ -33875,7 +33875,7 @@ snapshots: '@types/json-schema': 7.0.15 '@types/lodash': 4.17.23 is-glob: 4.0.3 - js-yaml: 4.1.1 + js-yaml: 4.3.2 lodash: 4.18.1 minimist: 1.2.8 prettier: 3.8.1 @@ -34520,7 +34520,7 @@ snapshots: find-up: 5.0.0 glob: 8.1.0 he: 1.2.0 - js-yaml: 4.1.1 + js-yaml: 4.3.2 log-symbols: 4.1.0 minimatch: 5.1.9 ms: 2.1.3 @@ -35989,7 +35989,7 @@ snapshots: read-yaml-file@2.1.0: dependencies: - js-yaml: 4.1.1 + js-yaml: 4.3.2 strip-bom: 4.0.0 read@1.0.7: @@ -38581,7 +38581,7 @@ snapshots: write-yaml-file@4.2.0: dependencies: - js-yaml: 4.1.1 + js-yaml: 4.3.2 write-file-atomic: 3.0.3 write@1.0.3: diff --git a/common/config/subspaces/default/repo-state.json b/common/config/subspaces/default/repo-state.json index 223742432c..8cd036f8e0 100644 --- a/common/config/subspaces/default/repo-state.json +++ b/common/config/subspaces/default/repo-state.json @@ -1,5 +1,5 @@ // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush. { - "pnpmShrinkwrapHash": "2f30cd63b9cd23e30220e1cc0b38ed652b12cf3a", + "pnpmShrinkwrapHash": "0e630c0958a5a477fc8ea05f8327239e95e3e5e5", "preferredVersionsHash": "029c99bd6e65c5e1f25e2848340509811ff9753c" } diff --git a/libraries/rush-lib/package.json b/libraries/rush-lib/package.json index 9eebb7059c..31ff05552d 100644 --- a/libraries/rush-lib/package.json +++ b/libraries/rush-lib/package.json @@ -70,7 +70,7 @@ "@inquirer/input": "~5.0.11", "@inquirer/search": "~4.1.7", "@inquirer/select": "~5.1.3", - "js-yaml": "~4.1.0", + "js-yaml": "~4.3.2", "npm-package-arg": "~6.1.0", "object-hash": "3.0.0", "pnpm-sync-lib": "0.3.4", diff --git a/repo-scripts/doc-plugin-rush-stack/package.json b/repo-scripts/doc-plugin-rush-stack/package.json index 5913c19295..0636bb173d 100644 --- a/repo-scripts/doc-plugin-rush-stack/package.json +++ b/repo-scripts/doc-plugin-rush-stack/package.json @@ -36,7 +36,7 @@ "@microsoft/api-extractor-model": "workspace:*", "@microsoft/tsdoc": "~0.17.0", "@rushstack/node-core-library": "workspace:*", - "js-yaml": "~4.1.0" + "js-yaml": "~4.3.2" }, "devDependencies": { "@rushstack/heft": "workspace:*",