From d152fad78817de265cfecf9835dea2ccc6f197a2 Mon Sep 17 00:00:00 2001 From: Waleed Date: Mon, 17 Aug 2026 14:22:38 -0700 Subject: [PATCH] chore(deps): bump js-yaml to 4.3.1 in sim-cli and drop the aged-out release-age waivers (#6784) js-yaml < 4.3.1 has quadratic CPU consumption in !!omap resolution (GHSA-5p4m-2wfm-xmqj / CVE-2026-59870). sim-cli builds with --packages=bundle, so its dev-scoped js-yaml is bundled into the published CLI. 4.3.1 is already what apps/sim pins, so this collapses sim-cli onto the hoisted copy. The minimumReleaseAge waivers for js-yaml and mermaid were temporary and have both aged past the 7-day window; leaving them behind would disable the supply-chain gate for those packages indefinitely. --- bun.lock | 4 +--- packages/sim-cli/package.json | 2 +- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/bun.lock b/bun.lock index ab7a7bc294..9eb05193a7 100644 --- a/bun.lock +++ b/bun.lock @@ -601,7 +601,7 @@ "@xterm/headless": "6.0.0", "chalk": "5.6.2", "commander": "^11.1.0", - "js-yaml": "4.3.0", + "js-yaml": "4.3.1", "typescript": "^7.0.2", "vitest": "^4.1.0", }, @@ -5290,8 +5290,6 @@ "serialize-error/type-fest": ["type-fest@0.13.1", "", {}, "sha512-34R7HTnG0XIJcBSn5XhDd7nNFPRcXYRZrBB2O2jdKqYODldSzBAqzsWoZYYvduky73toYS/ESqxPvkDf/F0XMg=="], - "sim/js-yaml": ["js-yaml@4.3.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q=="], - "slice-ansi/ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="], "slice-ansi/is-fullwidth-code-point": ["is-fullwidth-code-point@4.0.0", "", {}, "sha512-O4L094N2/dZ7xqVdrXhh9r1KODPJpFms8B5sGdJLPy664AgvXsreZUyCQQNItZRDlYug4xStLjNp/sz3HvBowQ=="], diff --git a/packages/sim-cli/package.json b/packages/sim-cli/package.json index 432ee0f3fb..856473edce 100644 --- a/packages/sim-cli/package.json +++ b/packages/sim-cli/package.json @@ -53,7 +53,7 @@ "@xterm/headless": "6.0.0", "chalk": "5.6.2", "commander": "^11.1.0", - "js-yaml": "4.3.0", + "js-yaml": "4.3.1", "typescript": "^7.0.2", "vitest": "^4.1.0" }