From fa6371e476ee717665a3d9addb362e06b400d37a Mon Sep 17 00:00:00 2001 From: Daniel Bannert Date: Tue, 21 Jul 2026 22:13:50 +0200 Subject: [PATCH] fix(deps): pin js-yaml override to 4.x to unbreak semantic-release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The audit-fix override `js-yaml@>=4.0.0 <4.3.0: ">=4.3.0"` was unbounded above, so pnpm resolved js-yaml 5.x, which is ESM-only with no default export. That broke multi-semantic-release (`import ... from "js-yaml"`) and failed the Semantic Release workflow on main, blocking all publishes. Bounds the override to `^4.3.0` — still patches GHSA-52cp-r559-cp3m but keeps js-yaml on 4.x with its default export. Verified: `multi-semantic-release --dry-run` loads every package again, and `pnpm audit --audit-level=moderate` reports no known vulnerabilities. Co-Authored-By: Claude Opus 4.8 --- pnpm-lock.yaml | 20 ++++++++++---------- pnpm-workspace.yaml | 4 +++- 2 files changed, 13 insertions(+), 11 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 7e9594e4e..c9dc982d8 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -618,7 +618,7 @@ overrides: yaml@>=2.0.0 <2.8.3: '>=2.8.4' esbuild@>=0.27.3 <0.28.1: '>=0.28.1' form-data@>=4.0.0 <4.0.6: '>=4.0.6' - js-yaml@>=4.0.0 <4.3.0: '>=4.3.0' + js-yaml@>=4.0.0 <4.3.0: ^4.3.0 importers: @@ -9202,8 +9202,8 @@ packages: resolution: {integrity: sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==} hasBin: true - js-yaml@5.2.1: - resolution: {integrity: sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==} + js-yaml@4.3.0: + resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} hasBin: true jsdoc-type-pratt-parser@7.2.0: @@ -13161,7 +13161,7 @@ snapshots: '@apidevtools/json-schema-ref-parser@14.2.1(@types/json-schema@7.0.15)': dependencies: '@types/json-schema': 7.0.15 - js-yaml: 5.2.1 + js-yaml: 4.3.0 '@arethetypeswrong/cli@0.18.5': dependencies: @@ -14249,7 +14249,7 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 5.2.1 + js-yaml: 4.3.0 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -15780,7 +15780,7 @@ snapshots: '@semrel-extra/topo@1.14.1': dependencies: fast-glob: 3.3.3 - js-yaml: 5.2.1 + js-yaml: 4.3.0 toposource: 1.2.0 '@simple-libs/child-process-utils@2.0.0': @@ -16135,7 +16135,7 @@ snapshots: '@textlint/types': 15.7.1 chalk: 4.1.2 debug: 4.4.3(supports-color@7.2.0) - js-yaml: 5.2.1 + js-yaml: 4.3.0 lodash: 4.18.1 pluralize: 2.0.0 string-width: 4.2.3 @@ -18305,7 +18305,7 @@ snapshots: dependencies: env-paths: 2.2.1 import-fresh: 3.3.1 - js-yaml: 5.2.1 + js-yaml: 4.3.0 parse-json: 5.2.0 optionalDependencies: typescript: 6.0.3 @@ -21521,7 +21521,7 @@ snapshots: argparse: 1.0.10 esprima: 4.0.1 - js-yaml@5.2.1: + js-yaml@4.3.0: dependencies: argparse: 2.0.1 @@ -23845,7 +23845,7 @@ snapshots: rc-config-loader@4.1.4: dependencies: debug: 4.4.3(supports-color@7.2.0) - js-yaml: 5.2.1 + js-yaml: 4.3.0 json5: 2.2.3 require-from-string: 2.0.2 transitivePeerDependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 6fe77af26..22a4fe7e2 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -280,7 +280,9 @@ overrides: yaml@>=2.0.0 <2.8.3: ">=2.8.4" esbuild@>=0.27.3 <0.28.1: ">=0.28.1" form-data@>=4.0.0 <4.0.6: ">=4.0.6" - js-yaml@>=4.0.0 <4.3.0: ">=4.3.0" + # Stay on 4.x: js-yaml 5.x is ESM-only with no default export and breaks + # multi-semantic-release's `import ... from "js-yaml"`. ^4.3.0 still patches GHSA-52cp-r559-cp3m. + js-yaml@>=4.0.0 <4.3.0: "^4.3.0" shellEmulator: true