Chore | +Claude | Pin js-yaml via npm override to resolve Snyk high-severity finding - #218
Merged
Merged
Conversation
…ding js-yaml@4.3.0 (pulled in transitively via @contentstack/cli-utilities, eslint-config-oclif, and mocha) is affected by SNYK-JS-JSYAML-18593780 (Inefficient Algorithmic Complexity, High severity), fixed in 4.3.1. All declared ranges (^4.1.0 etc.) already permit the patch bump, so a flat override is enough — no code changes required. Updates the .talismanrc checksum for package-lock.json to match the new lockfile hash (Talisman's secret scanner flags dependency hash changes for review). Verified with npm ci, npm run build, npm test, and a clean re-scan (snyk test: 0 vulnerable paths, was 1 issue / 2 vulnerable paths). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
There was a problem hiding this comment.
Pull request overview
Pins js-yaml via npm overrides to address a high-severity Snyk finding in the transitive dependency graph, and updates the lockfile and secret-scan allowlist checksum accordingly.
Changes:
- Adds an npm override for
js-yamlto bump it to^4.3.1. - Regenerates
package-lock.jsonto reflect the overridden resolution (including pruning now-unneeded nested deps). - Updates
.talismanrcchecksum for the updated lockfile.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Adds a js-yaml entry under overrides to force a patched version. |
| package-lock.json | Updates resolved js-yaml version to 4.3.1 and prunes no-longer-needed nested packages. |
| .talismanrc | Updates the stored checksum for package-lock.json. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
AryanBansal-launch
changed the title
rohan-agrawal-cs
approved these changes
Aug 10, 2026
Harshi-Shah-CS
approved these changes
Aug 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
SNYK-JS-JSYAML-18593780(Inefficient Algorithmic Complexity, High severity) injs-yaml@4.3.0, pulled in transitively via@contentstack/cli-utilities,eslint-config-oclif, andmocha.js-yaml: ^4.3.1npm override — all declared ranges (^4.1.0, etc.) already permit the patch bump, so no code changes were needed..talismanrcchecksum forpackage-lock.jsonto match the regenerated lockfile hash.Verification
npm ci— clean install against the updated lockfilenpm run build— passesnpm test— 129/129 Jest tests pass; mocha suite unchanged from baseline (pre-existing local-only failures gated onORG/ENVIRONMENT/PROJECTenv vars not present in this environment, unrelated to this change)snyk test— 0 vulnerable paths (was 1 issue / 2 vulnerable paths)Test plan
npm ci+ re-scan that the fix holds on a fresh install🤖 Generated with Claude Code