ds300 / ds300/patch-package

Security Vulnerability in peer dependancy "yaml" need to update to yaml 2.8.3

Open Beginner friendly
#617 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
TypeScript
Stars
11.2k
Forks
325
PR merge metrics
No merged PRs in 30d

Description

This library 'patch-package' is using yaml in its peer dependancies which is having security vulnerability and version of peer dependancy should be upgraded.

"yaml" vulnerability
Affected versions of this package are vulnerable to Uncontrolled Recursion in the compose/resolve phase due to using recursive function calls without a depth bound. An attacker can cause the application to throw a RangeError and potentially terminate the Node.js process by supplying a deeply nested YAML payload that exhausts the call stack.

Solution
Upgrade `yaml` to version 2.8.3 or higher.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the package metadata that declares the yaml peer dependency. Update the declared version to 2.8.3 or higher, then run the project's existing checks to confirm the dependency update does not break installation or tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, yaml
Domain
security, tooling
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
82/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.