Security Vulnerability in peer dependancy "yaml" need to update to yaml 2.8.3
- Dominant language
- TypeScript
- Stars
- 11.2k
- Forks
- 325
- PR merge metrics
- No merged PRs in 30d
Description
This library 'patch-package' is using yaml in its peer dependancies which is having security vulnerability and version of peer dependancy should be upgraded.
"yaml" vulnerability
Affected versions of this package are vulnerable to Uncontrolled Recursion in the compose/resolve phase due to using recursive function calls without a depth bound. An attacker can cause the application to throw a RangeError and potentially terminate the Node.js process by supplying a deeply nested YAML payload that exhausts the call stack.
Solution
Upgrade `yaml` to version 2.8.3 or higher.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the package metadata that declares the yaml peer dependency. Update the declared version to 2.8.3 or higher, then run the project's existing checks to confirm the dependency update does not break installation or tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, yaml
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 82/100