From ae897c4185e1c2c7015bc96820429ddd276f2b3d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 21 Aug 2026 21:48:10 +0000 Subject: [PATCH 1/2] Update js-yaml from ~4.1.0 to ~4.2.0 to address GHSA-h67p-54hq-rp68 Co-authored-by: dmichon-msft <26827560+dmichon-msft@users.noreply.github.com> --- apps/api-documenter/package.json | 2 +- apps/lockfile-explorer/package.json | 2 +- .../rush/update-js-yaml-security_2026-06-24-18-22.json | 10 ++++++++++ libraries/rush-lib/package.json | 2 +- repo-scripts/doc-plugin-rush-stack/package.json | 2 +- 5 files changed, 14 insertions(+), 4 deletions(-) create mode 100644 common/changes/@microsoft/rush/update-js-yaml-security_2026-06-24-18-22.json diff --git a/apps/api-documenter/package.json b/apps/api-documenter/package.json index 79c24b7de12..710721401d6 100644 --- a/apps/api-documenter/package.json +++ b/apps/api-documenter/package.json @@ -52,7 +52,7 @@ "@rushstack/node-core-library": "workspace:*", "@rushstack/terminal": "workspace:*", "@rushstack/ts-command-line": "workspace:*", - "js-yaml": "~4.1.0", + "js-yaml": "~4.2.0", "resolve": "~1.22.1" }, "devDependencies": { diff --git a/apps/lockfile-explorer/package.json b/apps/lockfile-explorer/package.json index 9bc1f73fd31..1630517f467 100644 --- a/apps/lockfile-explorer/package.json +++ b/apps/lockfile-explorer/package.json @@ -71,7 +71,7 @@ "@rushstack/ts-command-line": "workspace:*", "cors": "~2.8.5", "express": "4.21.1", - "js-yaml": "~4.1.0", + "js-yaml": "~4.2.0", "semver": "~7.7.4" }, "exports": { diff --git a/common/changes/@microsoft/rush/update-js-yaml-security_2026-06-24-18-22.json b/common/changes/@microsoft/rush/update-js-yaml-security_2026-06-24-18-22.json new file mode 100644 index 00000000000..fc101d14f73 --- /dev/null +++ b/common/changes/@microsoft/rush/update-js-yaml-security_2026-06-24-18-22.json @@ -0,0 +1,10 @@ +{ + "changes": [ + { + "comment": "Update js-yaml dependency to ~4.2.0 to address security advisory GHSA-h67p-54hq-rp68 (poor performance characteristics with certain input)", + "type": "none", + "packageName": "@microsoft/rush" + } + ], + "packageName": "@microsoft/rush" +} diff --git a/libraries/rush-lib/package.json b/libraries/rush-lib/package.json index c1e072cd268..a46a62d8d7d 100644 --- a/libraries/rush-lib/package.json +++ b/libraries/rush-lib/package.json @@ -68,7 +68,7 @@ "@inquirer/input": "~5.0.11", "@inquirer/search": "~4.1.7", "@inquirer/select": "~5.1.3", - "js-yaml": "~4.1.0", + "js-yaml": "~4.2.0", "npm-package-arg": "~6.1.0", "object-hash": "3.0.0", "pnpm-sync-lib": "0.3.4", diff --git a/repo-scripts/doc-plugin-rush-stack/package.json b/repo-scripts/doc-plugin-rush-stack/package.json index f398bfe0ed7..e0eb62877ff 100644 --- a/repo-scripts/doc-plugin-rush-stack/package.json +++ b/repo-scripts/doc-plugin-rush-stack/package.json @@ -36,7 +36,7 @@ "@microsoft/api-extractor-model": "workspace:*", "@microsoft/tsdoc": "~0.16.0", "@rushstack/node-core-library": "workspace:*", - "js-yaml": "~4.1.0" + "js-yaml": "~4.2.0" }, "devDependencies": { "@rushstack/heft": "workspace:*", From 30c61ae47ae5e6ca2f5f599746a269eaab8fd544 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 22 Sep 2026 18:05:43 +0000 Subject: [PATCH 2/2] Add missing js-yaml changefiles and lockfile update Co-authored-by: iclanton <5010588+iclanton@users.noreply.github.com> --- apps/api-documenter/package.json | 2 +- apps/lockfile-explorer/package.json | 2 +- ...ate-js-yaml-security_2026-09-22-17-52.json | 10 ++++ ...ate-js-yaml-security_2026-06-24-18-22.json | 10 ---- ...ate-js-yaml-security_2026-09-22-17-52.json | 10 ++++ ...ate-js-yaml-security_2026-09-22-17-52.json | 10 ++++ .../config/subspaces/default/pnpm-lock.yaml | 46 +++++++++---------- .../config/subspaces/default/repo-state.json | 2 +- libraries/rush-lib/package.json | 2 +- .../doc-plugin-rush-stack/package.json | 2 +- 10 files changed, 58 insertions(+), 38 deletions(-) create mode 100644 common/changes/@microsoft/api-documenter/update-js-yaml-security_2026-09-22-17-52.json delete mode 100644 common/changes/@microsoft/rush/update-js-yaml-security_2026-06-24-18-22.json create mode 100644 common/changes/@microsoft/rush/update-js-yaml-security_2026-09-22-17-52.json create mode 100644 common/changes/@rushstack/lockfile-explorer/update-js-yaml-security_2026-09-22-17-52.json diff --git a/apps/api-documenter/package.json b/apps/api-documenter/package.json index 33d8588a83e..2e3869f94e3 100644 --- a/apps/api-documenter/package.json +++ b/apps/api-documenter/package.json @@ -53,7 +53,7 @@ "@rushstack/node-core-library": "workspace:*", "@rushstack/terminal": "workspace:*", "@rushstack/ts-command-line": "workspace:*", - "js-yaml": "~4.2.0", + "js-yaml": "~4.3.2", "resolve": "~1.22.1" }, "devDependencies": { diff --git a/apps/lockfile-explorer/package.json b/apps/lockfile-explorer/package.json index e199d58caf0..8aed402638b 100644 --- a/apps/lockfile-explorer/package.json +++ b/apps/lockfile-explorer/package.json @@ -72,7 +72,7 @@ "@rushstack/ts-command-line": "workspace:*", "cors": "~2.8.5", "express": "4.21.1", - "js-yaml": "~4.2.0", + "js-yaml": "~4.3.2", "semver": "~7.7.4" }, "exports": { diff --git a/common/changes/@microsoft/api-documenter/update-js-yaml-security_2026-09-22-17-52.json b/common/changes/@microsoft/api-documenter/update-js-yaml-security_2026-09-22-17-52.json new file mode 100644 index 00000000000..12f1355683e --- /dev/null +++ b/common/changes/@microsoft/api-documenter/update-js-yaml-security_2026-09-22-17-52.json @@ -0,0 +1,10 @@ +{ + "changes": [ + { + "comment": "Update js-yaml dependency to ~4.3.2 to address security advisories for CPU consumption with certain inputs.", + "type": "patch", + "packageName": "@microsoft/api-documenter" + } + ], + "packageName": "@microsoft/api-documenter" +} diff --git a/common/changes/@microsoft/rush/update-js-yaml-security_2026-06-24-18-22.json b/common/changes/@microsoft/rush/update-js-yaml-security_2026-06-24-18-22.json deleted file mode 100644 index fc101d14f73..00000000000 --- a/common/changes/@microsoft/rush/update-js-yaml-security_2026-06-24-18-22.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "changes": [ - { - "comment": "Update js-yaml dependency to ~4.2.0 to address security advisory GHSA-h67p-54hq-rp68 (poor performance characteristics with certain input)", - "type": "none", - "packageName": "@microsoft/rush" - } - ], - "packageName": "@microsoft/rush" -} diff --git a/common/changes/@microsoft/rush/update-js-yaml-security_2026-09-22-17-52.json b/common/changes/@microsoft/rush/update-js-yaml-security_2026-09-22-17-52.json new file mode 100644 index 00000000000..02606adc965 --- /dev/null +++ b/common/changes/@microsoft/rush/update-js-yaml-security_2026-09-22-17-52.json @@ -0,0 +1,10 @@ +{ + "changes": [ + { + "comment": "Update js-yaml dependency to ~4.3.2 to address security advisories for CPU consumption with certain inputs.", + "type": "patch", + "packageName": "@microsoft/rush" + } + ], + "packageName": "@microsoft/rush" +} diff --git a/common/changes/@rushstack/lockfile-explorer/update-js-yaml-security_2026-09-22-17-52.json b/common/changes/@rushstack/lockfile-explorer/update-js-yaml-security_2026-09-22-17-52.json new file mode 100644 index 00000000000..65919600b7e --- /dev/null +++ b/common/changes/@rushstack/lockfile-explorer/update-js-yaml-security_2026-09-22-17-52.json @@ -0,0 +1,10 @@ +{ + "changes": [ + { + "comment": "Update js-yaml dependency to ~4.3.2 to address security advisories for CPU consumption with certain inputs.", + "type": "patch", + "packageName": "@rushstack/lockfile-explorer" + } + ], + "packageName": "@rushstack/lockfile-explorer" +} diff --git a/common/config/subspaces/default/pnpm-lock.yaml b/common/config/subspaces/default/pnpm-lock.yaml index 3c8af9d4de5..9aa69143376 100644 --- a/common/config/subspaces/default/pnpm-lock.yaml +++ b/common/config/subspaces/default/pnpm-lock.yaml @@ -37,8 +37,8 @@ importers: specifier: workspace:* version: link:../../libraries/ts-command-line js-yaml: - specifier: ~4.1.0 - version: 4.1.1 + specifier: ~4.3.2 + version: 4.3.2 resolve: specifier: ~1.22.1 version: 1.22.11 @@ -221,8 +221,8 @@ importers: specifier: 4.21.1 version: 4.21.1 js-yaml: - specifier: ~4.1.0 - version: 4.1.1 + specifier: ~4.3.2 + version: 4.3.2 semver: specifier: ~7.7.4 version: 7.7.4 @@ -4251,8 +4251,8 @@ importers: specifier: ~5.1.6 version: 5.1.9 js-yaml: - specifier: ~4.1.0 - version: 4.1.1 + specifier: ~4.3.2 + version: 4.3.2 npm-package-arg: specifier: ~6.1.0 version: 6.1.1 @@ -4677,8 +4677,8 @@ importers: specifier: workspace:* version: link:../../libraries/node-core-library js-yaml: - specifier: ~4.1.0 - version: 4.1.1 + specifier: ~4.3.2 + version: 4.3.2 devDependencies: '@rushstack/heft': specifier: workspace:* @@ -15148,8 +15148,8 @@ packages: resolution: {integrity: sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==} hasBin: true - js-yaml@4.1.1: - resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==} + js-yaml@4.3.2: + resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==} hasBin: true jscodeshift@0.13.1: @@ -19326,7 +19326,7 @@ snapshots: dependencies: '@jsdevtools/ono': 7.1.3 '@types/json-schema': 7.0.15 - js-yaml: 4.1.1 + js-yaml: 4.3.2 '@asamuzakjp/css-color@3.2.0': dependencies: @@ -21528,7 +21528,7 @@ snapshots: globals: 13.24.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.1.1 + js-yaml: 4.3.2 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -21542,7 +21542,7 @@ snapshots: globals: 13.24.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.1.1 + js-yaml: 4.3.2 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -21556,7 +21556,7 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.1.1 + js-yaml: 4.3.2 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -25194,7 +25194,7 @@ snapshots: express: 4.21.1 fs-extra: 9.1.0 immer: 9.0.21 - js-yaml: 4.1.1 + js-yaml: 4.3.2 kysely: 0.21.6 kysely-codegen: 0.6.2(kysely@0.21.6) kysely-data-api: 0.1.4(aws-sdk@2.1693.0)(kysely@0.21.6) @@ -31063,7 +31063,7 @@ snapshots: imurmurhash: 0.1.4 is-glob: 4.0.3 js-sdsl: 4.4.2 - js-yaml: 4.1.1 + js-yaml: 4.3.2 json-stable-stringify-without-jsonify: 1.0.1 levn: 0.4.1 lodash.merge: 4.6.2 @@ -31108,7 +31108,7 @@ snapshots: imurmurhash: 0.1.4 is-glob: 4.0.3 is-path-inside: 3.0.3 - js-yaml: 4.1.1 + js-yaml: 4.3.2 json-stable-stringify-without-jsonify: 1.0.1 levn: 0.4.1 lodash.merge: 4.6.2 @@ -31146,7 +31146,7 @@ snapshots: import-fresh: 3.3.1 imurmurhash: 0.1.4 is-glob: 4.0.3 - js-yaml: 4.1.1 + js-yaml: 4.3.2 json-stable-stringify-without-jsonify: 1.0.1 levn: 0.4.1 lodash.merge: 4.6.2 @@ -33774,7 +33774,7 @@ snapshots: argparse: 1.0.10 esprima: 4.0.1 - js-yaml@4.1.1: + js-yaml@4.3.2: dependencies: argparse: 2.0.1 @@ -33875,7 +33875,7 @@ snapshots: '@types/json-schema': 7.0.15 '@types/lodash': 4.17.23 is-glob: 4.0.3 - js-yaml: 4.1.1 + js-yaml: 4.3.2 lodash: 4.18.1 minimist: 1.2.8 prettier: 3.8.1 @@ -34520,7 +34520,7 @@ snapshots: find-up: 5.0.0 glob: 8.1.0 he: 1.2.0 - js-yaml: 4.1.1 + js-yaml: 4.3.2 log-symbols: 4.1.0 minimatch: 5.1.9 ms: 2.1.3 @@ -35989,7 +35989,7 @@ snapshots: read-yaml-file@2.1.0: dependencies: - js-yaml: 4.1.1 + js-yaml: 4.3.2 strip-bom: 4.0.0 read@1.0.7: @@ -38581,7 +38581,7 @@ snapshots: write-yaml-file@4.2.0: dependencies: - js-yaml: 4.1.1 + js-yaml: 4.3.2 write-file-atomic: 3.0.3 write@1.0.3: diff --git a/common/config/subspaces/default/repo-state.json b/common/config/subspaces/default/repo-state.json index 223742432c4..8cd036f8e0c 100644 --- a/common/config/subspaces/default/repo-state.json +++ b/common/config/subspaces/default/repo-state.json @@ -1,5 +1,5 @@ // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush. { - "pnpmShrinkwrapHash": "2f30cd63b9cd23e30220e1cc0b38ed652b12cf3a", + "pnpmShrinkwrapHash": "0e630c0958a5a477fc8ea05f8327239e95e3e5e5", "preferredVersionsHash": "029c99bd6e65c5e1f25e2848340509811ff9753c" } diff --git a/libraries/rush-lib/package.json b/libraries/rush-lib/package.json index b298471d92d..31ff05552d7 100644 --- a/libraries/rush-lib/package.json +++ b/libraries/rush-lib/package.json @@ -70,7 +70,7 @@ "@inquirer/input": "~5.0.11", "@inquirer/search": "~4.1.7", "@inquirer/select": "~5.1.3", - "js-yaml": "~4.2.0", + "js-yaml": "~4.3.2", "npm-package-arg": "~6.1.0", "object-hash": "3.0.0", "pnpm-sync-lib": "0.3.4", diff --git a/repo-scripts/doc-plugin-rush-stack/package.json b/repo-scripts/doc-plugin-rush-stack/package.json index abaa5c197ad..0636bb173df 100644 --- a/repo-scripts/doc-plugin-rush-stack/package.json +++ b/repo-scripts/doc-plugin-rush-stack/package.json @@ -36,7 +36,7 @@ "@microsoft/api-extractor-model": "workspace:*", "@microsoft/tsdoc": "~0.17.0", "@rushstack/node-core-library": "workspace:*", - "js-yaml": "~4.2.0" + "js-yaml": "~4.3.2" }, "devDependencies": { "@rushstack/heft": "workspace:*",