chore(deps-dev): bump js-yaml from 5.2.1 to 5.2.2#1257
Conversation
github-actions
Bot
added
lang:js
github-actions
Bot
added
the
meta:dependabot-security
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cb96477d25
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "node_modules/markdownlint-cli2/node_modules/js-yaml": { | ||
| "version": "5.2.1", | ||
| "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.1.tgz", | ||
| "integrity": "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==", |
There was a problem hiding this comment.
This security bump still locks markdownlint-cli2 to js-yaml 5.2.1: the newly added nested package is installed because markdownlint-cli2 depends on the exact 5.2.1 entry in this lockfile, so runs of npm run lint:md/format:md continue to execute the unpatched parser that this PR is meant to remove. Add an npm override or update markdownlint-cli2 so every js-yaml instance resolves to 5.2.2.
Useful? React with 👍 / 👎.
cb96477 to
8f3fea3
Compare
github-actions
Bot
removed
the
meta:dependabot-security
6198e62 to
0455809
Compare
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 5.2.1 to 5.2.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@5.2.1...5.2.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.2 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
0455809 to
7248f16
Compare
1 participant
Bumps js-yaml from 5.2.1 to 5.2.2.
Changelog
Sourced from js-yaml's changelog.
Commits
3c295595.2.2 released3e5240fparser: avoid reparsing flow sequence pair keysbd7ebb2fix: quote flow scalars where a colon precedes a flow indicator (#773)