Skip to content

fix: resolve js-yaml to ^5.2.1 to address CVE-2026-59869 #1976

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
netomi merged 2 commits into from
Jul 16, 2026
+11 −6
Merged

fix: resolve js-yaml to ^5.2.1 to address CVE-2026-59869 #1976

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d3b6d6e
fix: resolve js-yaml to ^5.2.1 to address CVE-2026-59869
vinokurig Jul 16, 2026
9876a64
instead of resolve to 5.2.1 bump to fixed version 4.3.0 and add chang…
netomi Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions cli/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,10 @@ This change log covers only the command line interface (CLI) of Open VSX.
- Replace `keytar` with `cross-keychain` to store credentials in the system keychain ([#1950](https://github.com/eclipse/openvsx/pull/1950))
- Mask token input when using `login` command ([#1966](https://github.com/eclipse-openvsx/openvsx/pull/1966)

#### Dependencies

- Bump js-yaml from `4.2.0` to `4.3.0` ([#1976](https://github.com/eclipse/openvsx/pull/1976))

### [v1.0.2] (23/06/2026)

#### Dependencies
Expand Down
6 changes: 3 additions & 3 deletions cli/yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3136,13 +3136,13 @@ __metadata:
linkType: hard

"js-yaml@npm:^4.1.0, js-yaml@npm:^4.1.1":
version: 4.2.0
resolution: "js-yaml@npm:4.2.0"
version: 4.3.0
resolution: "js-yaml@npm:4.3.0"
dependencies:
argparse: "npm:^2.0.1"
bin:
js-yaml: bin/js-yaml.js
checksum: 10/51de2067a2b44b07ba5206132e56005f8b568ff279bb4d2f645068958c56fa4827d40a6841c983234671fa0a134bf094d0b0717873c2a3d319185297af145a6d
checksum: 10/2bcec3a8118d7f744badeb04e14366578d234a736f353d41fe35d2305e4ce2409a8e041d277f07cd6bbc8aaa12128d650a68ce43247072519bede20962d2126f
languageName: node
linkType: hard

Expand Down
1 change: 1 addition & 0 deletions webui/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ This change log covers only the frontend library (webui) of Open VSX.
- Bump brace-expansion from `2.0.2` to `2.1.1` ([#1944](https://github.com/eclipse-openvsx/openvsx/pull/1944))
- Bump brace-expansion from `5.0.3` to `5.0.7` ([#1944](https://github.com/eclipse-openvsx/openvsx/pull/1944))
- Bump tar from `7.5.16` to `7.5.19` ([#1959](https://github.com/eclipse-openvsx/openvsx/pull/1959))
- Bump js-yaml from `4.2.0` to `4.3.0` ([#1976](https://github.com/eclipse-openvsx/openvsx/pull/1976))

## [v1.0.2] (23/06/2026)

Expand Down
6 changes: 3 additions & 3 deletions webui/yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5170,13 +5170,13 @@ __metadata:
linkType: hard

"js-yaml@npm:^4.1.1":
version: 4.2.0
resolution: "js-yaml@npm:4.2.0"
version: 4.3.0
resolution: "js-yaml@npm:4.3.0"
dependencies:
argparse: "npm:^2.0.1"
bin:
js-yaml: bin/js-yaml.js
checksum: 10/51de2067a2b44b07ba5206132e56005f8b568ff279bb4d2f645068958c56fa4827d40a6841c983234671fa0a134bf094d0b0717873c2a3d319185297af145a6d
checksum: 10/2bcec3a8118d7f744badeb04e14366578d234a736f353d41fe35d2305e4ce2409a8e041d277f07cd6bbc8aaa12128d650a68ce43247072519bede20962d2126f
languageName: node
linkType: hard

Expand Down