fix(deps): scope js-yaml to 4.2.0 under the mintlify/verdaccio pinners (#22078)

## Summary

Resolves [Dependabot alert
#1504](https://github.com/twentyhq/twenty/security/dependabot/1504) —
js-yaml **CVE-2026-53550 / GHSA-h67p-54hq-rp68** (quadratic-complexity
DoS in YAML merge-key handling, vulnerable `<=4.1.1`, fixed `4.2.0`) —
by lifting the vulnerable **js-yaml 4.1.1 → 4.2.0**.

## Why scoped resolutions (not a global pin)

- js-yaml 4.1.1 is held alive by **7 packages that hard-pin it exact**
(no caret, still 4.1.1 in their latest):
`@mintlify/{cli,common,prebuild,previewing,scraping,validation}` +
`@verdaccio/config`. No parent upgrade carries the fix, so each is
scoped to 4.2.0 — matching the repo's `parent/child` convention.
- The 5 alert paths (`@graphql-codegen/cli`, `@lingui/cli`,
`@lingui/vite-plugin`, `@wyw-in-js/vite`, `vite-plugin-svgr`) only
*shared* that 4.1.1 via `cosmiconfig` (`^4.1.0`) — once the exact pins
are lifted, they **dedupe onto 4.2.0 on their own**.
- Forcing 4.1.1 → 4.2.0 is a **safe minor** (same 4.x `.load` API; the
fix just bounds merge-key complexity).

## The js-yaml 3.x remnant (deliberately left)

`front-matter@4.0.2` (via mintlify) and
`@istanbuljs/load-nyc-config@1.1.0` (via storybook coverage) declare
`js-yaml ^3.13.1 → 3.14.2`. **front-matter calls the `safeLoad` API that
js-yaml 4.x removed**, so it cannot take 4.2.0 — a global pin would
break it (which is why this is scoped). That 3.x copy is left in place;
both parse only **first-party trusted YAML** (nycrc + docs
front-matter), so the merge-key DoS isn't reachable. If Dependabot still
flags that 3.x copy, it's a dismiss candidate (no safe transitive fix —
front-matter is EOL on the `safeLoad` API).

## Verification

- `yarn install --immutable` passes.
- No `js-yaml@4.1.1` remains; js-yaml is now `4.2.0` (+ the documented
`3.14.2` remnant).
- Diff is js-yaml-only; matching `"//resolutions"` doc entry included.

This commit is contained in:

Abdullah.

2026-06-24 18:24:00 +05:00

committed by

GitHub

parent ad3c82bd15

commit 20ac0a52bf

2 changed files with 12 additions and 5 deletions

package.json

+8 -1

View File

File diff suppressed because one or more lines are too long