From ec0be07682ba3b3ea4617024c353e2aaaefe447f Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Date: Sat, 25 Jul 2026 10:35:05 -0300
Subject: [PATCH] chore(deps): patch js-yaml + postcss for 2 high Dependabot
 alerts (#8572)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

js-yaml 5.2.1 -> 5.2.2 (GHSA-pm4m-ph32-ghv5, CWE-407: exponential parsing time in flow collections — a <200-byte payload hangs load()).
postcss 8.5.14 -> 8.5.23 (GHSA-r28c-9q8g-f849, CWE-22: path traversal via auto-loaded sourceMappingURL discloses arbitrary .map files).

Scoped override keeps promptfoo off its exact js-yaml@5.2.1 pin while holding
@apidevtools/json-schema-ref-parser on js-yaml ^4.2.0, so the nested override does
not major that subtree. Lockfile diff is exactly three versions (plus postcss's own
nanoid); nothing added or removed. check:lockfile passes.

Closes Dependabot #146 and #148.
---
 package-lock.json | 24 ++++++++++++------------
 package.json      | 12 +++++++++---
 2 files changed, 21 insertions(+), 15 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index a668a06640..9013afaec5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -44,7 +44,7 @@
         "ink-text-input": "^6.0.0",
         "ioredis": "^5.10.1",
         "jose": "^6.2.3",
-        "js-yaml": "^5.0.0",
+        "js-yaml": "^5.2.2",
         "jsonc-parser": "^3.3.1",
         "lowdb": "^7.0.1",
         "lucide-react": "^1.21.0",
@@ -103,7 +103,7 @@
         "@testing-library/jest-dom": "^6.9.1",
         "@testing-library/react": "^16.3.2",
         "@types/better-sqlite3": "^7.6.13",
-        "@types/bun": "*",
+        "@types/bun": "latest",
         "@types/node": "^26.1.0",
         "@types/react": "^19.2.15",
         "@types/react-dom": "^19.2.3",
@@ -23683,9 +23683,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.1.tgz",
-      "integrity": "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==",
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.2.tgz",
+      "integrity": "sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==",
       "funding": [
         {
           "type": "github",
@@ -27778,9 +27778,9 @@
       "optional": true
     },
     "node_modules/nanoid": {
-      "version": "3.3.11",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "version": "3.3.16",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
+      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
       "funding": [
         {
           "type": "github",
@@ -30080,9 +30080,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.14",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz",
-      "integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==",
+      "version": "8.5.23",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz",
+      "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==",
       "funding": [
         {
           "type": "opencollective",
@@ -30099,7 +30099,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.11",
+        "nanoid": "^3.3.16",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
diff --git a/package.json b/package.json
index 80b95385ca..acfa0e9336 100644
--- a/package.json
+++ b/package.json
@@ -265,7 +265,7 @@
     "ink-text-input": "^6.0.0",
     "ioredis": "^5.10.1",
     "jose": "^6.2.3",
-    "js-yaml": "^5.0.0",
+    "js-yaml": "^5.2.2",
     "jsonc-parser": "^3.3.1",
     "lowdb": "^7.0.1",
     "lucide-react": "^1.21.0",
@@ -394,7 +394,7 @@
     "dompurify": "^3.4.12",
     "fast-xml-parser": "^5.10.1",
     "sharp": "^0.35.0",
-    "postcss": "^8.5.14",
+    "postcss": "^8.5.18",
     "ip-address": "10.2.0",
     "qs": "^6.15.2",
     "uuid": "^14.0.0",
@@ -418,6 +418,12 @@
     "concurrently": {
       "shell-quote": "^1.9.0"
     },
-    "adm-zip": "^0.6.0"
+    "adm-zip": "^0.6.0",
+    "promptfoo": {
+      "js-yaml": "^5.2.2",
+      "@apidevtools/json-schema-ref-parser": {
+        "js-yaml": "^4.2.0"
+      }
+    }
   }
 }