From 854978169c4322209fe606ce2e85f4a77cba6b2b Mon Sep 17 00:00:00 2001 From: Julia Silge Date: Mon, 27 Jul 2026 13:23:27 -0600 Subject: [PATCH] Ignore js-yaml merge advisory, patch brace-expansion for real --- .snyk | 15 +++++++++++++++ apps/lsp/.snyk | 15 +++++++++++++++ apps/vscode-markdownit/.snyk | 15 +++++++++++++++ apps/vscode/.snyk | 15 +++++++++++++++ packages/editor-server/.snyk | 15 +++++++++++++++ packages/editor/.snyk | 15 +++++++++++++++ packages/ojs/quarto-ojs-runtime/.snyk | 15 +++++++++++++++ packages/quarto-core/.snyk | 15 +++++++++++++++ 8 files changed, 120 insertions(+) create mode 100644 .snyk create mode 100644 apps/lsp/.snyk create mode 100644 apps/vscode-markdownit/.snyk create mode 100644 apps/vscode/.snyk create mode 100644 packages/editor-server/.snyk create mode 100644 packages/editor/.snyk create mode 100644 packages/ojs/quarto-ojs-runtime/.snyk create mode 100644 packages/quarto-core/.snyk diff --git a/.snyk b/.snyk new file mode 100644 index 000000000..0dbcf0548 --- /dev/null +++ b/.snyk @@ -0,0 +1,15 @@ +# Snyk (https://snyk.io) policy file +version: v1.25.0 +ignore: + SNYK-JS-JSYAML-18313070: + - '*': + reason: >- + No fix exists in the js-yaml 4.x line as of 2026-07-27; the advisory is + fixed only in 5.2.2, and js-yaml 5.0.0 is a breaking rewrite (flat named + exports, YAML 1.2 number parsing instead of 1.1, reorganized schema + exports) that needs a deliberate migration rather than an automated bump. + Exposure here is limited: the affected parse path handles front matter and + config from documents the user has already opened locally, not untrusted + network input, so the worst case is a self-inflicted editor hang. Revisit + when a 4.x backport lands or the 5.x migration is scheduled. + expires: '2026-10-25T00:00:00.000Z' diff --git a/apps/lsp/.snyk b/apps/lsp/.snyk new file mode 100644 index 000000000..0dbcf0548 --- /dev/null +++ b/apps/lsp/.snyk @@ -0,0 +1,15 @@ +# Snyk (https://snyk.io) policy file +version: v1.25.0 +ignore: + SNYK-JS-JSYAML-18313070: + - '*': + reason: >- + No fix exists in the js-yaml 4.x line as of 2026-07-27; the advisory is + fixed only in 5.2.2, and js-yaml 5.0.0 is a breaking rewrite (flat named + exports, YAML 1.2 number parsing instead of 1.1, reorganized schema + exports) that needs a deliberate migration rather than an automated bump. + Exposure here is limited: the affected parse path handles front matter and + config from documents the user has already opened locally, not untrusted + network input, so the worst case is a self-inflicted editor hang. Revisit + when a 4.x backport lands or the 5.x migration is scheduled. + expires: '2026-10-25T00:00:00.000Z' diff --git a/apps/vscode-markdownit/.snyk b/apps/vscode-markdownit/.snyk new file mode 100644 index 000000000..0dbcf0548 --- /dev/null +++ b/apps/vscode-markdownit/.snyk @@ -0,0 +1,15 @@ +# Snyk (https://snyk.io) policy file +version: v1.25.0 +ignore: + SNYK-JS-JSYAML-18313070: + - '*': + reason: >- + No fix exists in the js-yaml 4.x line as of 2026-07-27; the advisory is + fixed only in 5.2.2, and js-yaml 5.0.0 is a breaking rewrite (flat named + exports, YAML 1.2 number parsing instead of 1.1, reorganized schema + exports) that needs a deliberate migration rather than an automated bump. + Exposure here is limited: the affected parse path handles front matter and + config from documents the user has already opened locally, not untrusted + network input, so the worst case is a self-inflicted editor hang. Revisit + when a 4.x backport lands or the 5.x migration is scheduled. + expires: '2026-10-25T00:00:00.000Z' diff --git a/apps/vscode/.snyk b/apps/vscode/.snyk new file mode 100644 index 000000000..0dbcf0548 --- /dev/null +++ b/apps/vscode/.snyk @@ -0,0 +1,15 @@ +# Snyk (https://snyk.io) policy file +version: v1.25.0 +ignore: + SNYK-JS-JSYAML-18313070: + - '*': + reason: >- + No fix exists in the js-yaml 4.x line as of 2026-07-27; the advisory is + fixed only in 5.2.2, and js-yaml 5.0.0 is a breaking rewrite (flat named + exports, YAML 1.2 number parsing instead of 1.1, reorganized schema + exports) that needs a deliberate migration rather than an automated bump. + Exposure here is limited: the affected parse path handles front matter and + config from documents the user has already opened locally, not untrusted + network input, so the worst case is a self-inflicted editor hang. Revisit + when a 4.x backport lands or the 5.x migration is scheduled. + expires: '2026-10-25T00:00:00.000Z' diff --git a/packages/editor-server/.snyk b/packages/editor-server/.snyk new file mode 100644 index 000000000..0dbcf0548 --- /dev/null +++ b/packages/editor-server/.snyk @@ -0,0 +1,15 @@ +# Snyk (https://snyk.io) policy file +version: v1.25.0 +ignore: + SNYK-JS-JSYAML-18313070: + - '*': + reason: >- + No fix exists in the js-yaml 4.x line as of 2026-07-27; the advisory is + fixed only in 5.2.2, and js-yaml 5.0.0 is a breaking rewrite (flat named + exports, YAML 1.2 number parsing instead of 1.1, reorganized schema + exports) that needs a deliberate migration rather than an automated bump. + Exposure here is limited: the affected parse path handles front matter and + config from documents the user has already opened locally, not untrusted + network input, so the worst case is a self-inflicted editor hang. Revisit + when a 4.x backport lands or the 5.x migration is scheduled. + expires: '2026-10-25T00:00:00.000Z' diff --git a/packages/editor/.snyk b/packages/editor/.snyk new file mode 100644 index 000000000..0dbcf0548 --- /dev/null +++ b/packages/editor/.snyk @@ -0,0 +1,15 @@ +# Snyk (https://snyk.io) policy file +version: v1.25.0 +ignore: + SNYK-JS-JSYAML-18313070: + - '*': + reason: >- + No fix exists in the js-yaml 4.x line as of 2026-07-27; the advisory is + fixed only in 5.2.2, and js-yaml 5.0.0 is a breaking rewrite (flat named + exports, YAML 1.2 number parsing instead of 1.1, reorganized schema + exports) that needs a deliberate migration rather than an automated bump. + Exposure here is limited: the affected parse path handles front matter and + config from documents the user has already opened locally, not untrusted + network input, so the worst case is a self-inflicted editor hang. Revisit + when a 4.x backport lands or the 5.x migration is scheduled. + expires: '2026-10-25T00:00:00.000Z' diff --git a/packages/ojs/quarto-ojs-runtime/.snyk b/packages/ojs/quarto-ojs-runtime/.snyk new file mode 100644 index 000000000..0dbcf0548 --- /dev/null +++ b/packages/ojs/quarto-ojs-runtime/.snyk @@ -0,0 +1,15 @@ +# Snyk (https://snyk.io) policy file +version: v1.25.0 +ignore: + SNYK-JS-JSYAML-18313070: + - '*': + reason: >- + No fix exists in the js-yaml 4.x line as of 2026-07-27; the advisory is + fixed only in 5.2.2, and js-yaml 5.0.0 is a breaking rewrite (flat named + exports, YAML 1.2 number parsing instead of 1.1, reorganized schema + exports) that needs a deliberate migration rather than an automated bump. + Exposure here is limited: the affected parse path handles front matter and + config from documents the user has already opened locally, not untrusted + network input, so the worst case is a self-inflicted editor hang. Revisit + when a 4.x backport lands or the 5.x migration is scheduled. + expires: '2026-10-25T00:00:00.000Z' diff --git a/packages/quarto-core/.snyk b/packages/quarto-core/.snyk new file mode 100644 index 000000000..0dbcf0548 --- /dev/null +++ b/packages/quarto-core/.snyk @@ -0,0 +1,15 @@ +# Snyk (https://snyk.io) policy file +version: v1.25.0 +ignore: + SNYK-JS-JSYAML-18313070: + - '*': + reason: >- + No fix exists in the js-yaml 4.x line as of 2026-07-27; the advisory is + fixed only in 5.2.2, and js-yaml 5.0.0 is a breaking rewrite (flat named + exports, YAML 1.2 number parsing instead of 1.1, reorganized schema + exports) that needs a deliberate migration rather than an automated bump. + Exposure here is limited: the affected parse path handles front matter and + config from documents the user has already opened locally, not untrusted + network input, so the worst case is a self-inflicted editor hang. Revisit + when a 4.x backport lands or the 5.x migration is scheduled. + expires: '2026-10-25T00:00:00.000Z'