fix(deps): scope js-yaml override by version range to unbreak docs deploy#1830
Open
steilerDev wants to merge 1 commit into
Open
fix(deps): scope js-yaml override by version range to unbreak docs deploy#1830steilerDev wants to merge 1 commit into
steilerDev wants to merge 1 commit into
Conversation
The blanket js-yaml=4.2.0 override from #1733 forced gray-matter (which requires the js-yaml 3.x safeLoad API) onto 4.x, breaking Docusaurus front-matter parsing and failing the Docs Deploy job on every stable release since. Replace the blanket override with version-ranged overrides that patch CVE-2026-53550 within each major line: vulnerable 4.x -> 4.2.0, vulnerable 3.x -> 3.15.0 (the patched 3.x release per the advisory). gray-matter now resolves js-yaml 3.15.0; docs build verified locally; npm audit reports 0 vulnerabilities. Fixes #1827 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix for #1827: the
Docs Deployjob has failed on the last two stable releases (including today's v2.12.0) because the blanketjs-yaml: 4.2.0override from #1733 forcesgray-matter— which needs the js-yaml 3.xsafeLoadAPI — onto 4.x, breaking Docusaurus front-matter parsing.Fix
Replace the blanket override with version-ranged overrides that still fully remediate CVE-2026-53550, but within each major line (matching the advisory's patched versions):
js-yaml@>=4.0.0 <4.2.0→4.2.0js-yaml@<3.15.0→3.15.0(patched 3.x release)gray-matternow resolves js-yaml3.15.0(nested install), everything else stays on4.2.0.Verification
npm run docs:buildsucceeds locally (previously failed withFunction yaml.safeLoad is removed in js-yaml 4)npm ls js-yaml— no invalid edges;npm audit— 0 vulnerabilitiesnpm installAfter this merges to beta, a follow-up beta → main promotion will cut a patch release whose
Docs Deploypublishes the v2.12.0 documentation.Supersedes #1828. Fixes #1827
🤖 Generated with Claude Code