Diego Rodrigues de Sa e Souza ec0be07682 chore(deps): patch js-yaml + postcss for 2 high Dependabot alerts (#8572) ...

js-yaml 5.2.1 -> 5.2.2 (GHSA-pm4m-ph32-ghv5, CWE-407: exponential parsing time in flow collections — a <200-byte payload hangs load()).
postcss 8.5.14 -> 8.5.23 (GHSA-r28c-9q8g-f849, CWE-22: path traversal via auto-loaded sourceMappingURL discloses arbitrary .map files).

Scoped override keeps promptfoo off its exact js-yaml@5.2.1 pin while holding
@apidevtools/json-schema-ref-parser on js-yaml ^4.2.0, so the nested override does
not major that subtree. Lockfile diff is exactly three versions (plus postcss's own
nanoid); nothing added or removed. check:lockfile passes.

Closes Dependabot #146 and #148.

2026-07-25 10:35:05 -03:00

28 KiB

Raw Blame History

View Raw