swagger-api / swagger-api/swagger-ui
Allow compatible js-yaml patch updates
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 29k
- Forks
- 9.3k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 25
Description
js-yaml is currently pinned exactly:
"js-yaml": "=4.3.1"
This prevents consumers from receiving compatible security patch releases.
For example, GHSA-2883-xcg3-v3hh is fixed in js-yaml 4.3.2, but npm/Dependabot cannot update to it because Swagger UI requires exactly 4.3.1. As a result, the vulnerability remains in downstream projects until Swagger UI publishes another release.
This has happened with previous js-yaml security fixes as well, and js-yaml has had multiple security advisories over time, so exact pinning makes this a recurring problem.
Is there a reason js-yaml cannot use a compatible v4 range, e.g. ^4.3.2?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Search the repository for the js-yaml dependency declaration and inspect how its version is pinned. Verify that a compatible v4 range resolves to a patched release, then run the relevant dependency checks; done means consumers can receive compatible security patches without an exact 4.3.1 pin.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 78/100