chore(deps): fix 3 new high dependabot alerts (js-yaml, brace-expansion) - #30
Merged
Conversation
Advisories published 2026-07-27: - js-yaml 5.2.1 -> 5.2.2 (GHSA-pm4m-ph32-ghv5, DoS via exponential parsing) - the existing overrides pinned 5.2.1, which just became vulnerable itself. - brace-expansion 5.0.7 -> 5.0.8 (GHSA-mh99-v99m-4gvg, DoS/OOM) in both frontend and desktop (desktop not flagged yet, same vulnerable version). All transitive build tooling (eslint/minimatch chains). Frontend builds clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Preview DeploymentPreview deployments for this PR are available at:
The preview environment will start automatically on first visit. Subsequent pushes to this PR will update the Run locally with Dockerdocker pull ghcr.io/docsales/vikunja:pr-30
docker run -p 3456:3456 ghcr.io/docsales/vikunja:pr-30Last updated for commit f7c2621 |
…lection_ReadAll, unrelated to lockfile bumps)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Right after #29 cleared the first 3 alerts, Dependabot's rescan surfaced 3 brand-new highs from advisories published today (2026-07-27):
js-yaml5.2.1brace-expansion5.0.7Both are transitive build tooling (eslint/minimatch chains); frontend
js-yaml@3.15.0is outside the vulnerable range (>=5.0.0) and untouched.pnpm installclean in both dirs, full frontend build passes.🤖 Generated with Claude Code