Skip to content

Fix js-yaml vulnerability - #21

Merged
ggogobera merged 2 commits into
masterfrom
fix-vuln
Aug 13, 2026
Merged

Fix js-yaml vulnerability#21
ggogobera merged 2 commits into
masterfrom
fix-vuln

Conversation

@ggogobera

Copy link
Copy Markdown
Member

Closes https://github.com/closeio/github-retry-action/security/dependabot/95

Instead of overriding, I updated Jest and related packages.

jest: requires js-yaml@^3.13.1 (via @istanbuljs/load-nyc-config@1.1.0)
The earliest fixed version is 3.15.1.

Now load-nyc-config uses patched version:

"node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": {
"version": "3.15.1",

CleanShot 2026-08-13 at 18 11 35@2x

@ggogobera
ggogobera merged commit 586a026 into master Aug 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant