Vulnerability in yaml dependency

Are you reporting a bug or runtime error?

Vulnerability

Output of running jf audit --extended-table in the project root directory:

┌──────────┬──────────────┬────────────┬────────────┬────────────┬──────────┬──────┬───────────────┬──────┬──────┬───────────┐
│ SEVERITY │ DIRECT       │ DIRECT     │ IMPACTED   │ IMPACTED   │ FIXED    │ TYPE │ CVE           │ CVSS │ CVSS │ ISSUE ID  │
│          │ DEPENDENCY   │ DEPENDENCY │ DEPENDENCY │ DEPENDENCY │ VERSIONS │      │               │ V2   │ V3   │           │
│          │              │ VERSION    │ NAME       │ VERSION    │          │      │               │      │      │           │
├──────────┼──────────────┼────────────┼────────────┼────────────┼──────────┼──────┼───────────────┼──────┼──────┼───────────┤
│ Medium   │ react-select │ 5.7.7      │ yaml       │ 1.10.2     │ [2.2.2,) │ npm  │ CVE-2023-2251 │      │      │ XRAY-N187 │
│          │              │            │            │            │          │      │               │      │      │           │
└──────────┴──────────────┴────────────┴────────────┴────────────┴──────────┴──────┴───────────────┴──────┴──────┴───────────┘

Need to update yaml dependency to the latest version.

Locate the dependency manifest and lockfile that declare yaml, then inspect how react-select 5.7.7 resolves it. Update yaml to a version at or above the reported fixed range and rerun jf audit --extended-table; done means CVE-2023-2251 is no longer reported.