From b1d547b0f7852545cf4569826423f89283dc2e51 Mon Sep 17 00:00:00 2001 From: Amit Sharma Date: Fri, 18 Sep 2026 14:03:52 +0530 Subject: [PATCH] =?UTF-8?q?chore(deps):=20patch-duty=20=E2=80=94=20js-yaml?= =?UTF-8?q?=203.15.2=20(GHSA-2883-xcg3-v3hh)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Lockfile-only. js-yaml 3.15.1 -> 3.15.2, the patched version for GHSA-2883-xcg3-v3hh (maxTotalMergeKeys does not limit CPU use for empty merge sources). Takes the JS tree to 0 advisories. Also syncs the recorded version of the local packages/js-sdk workspace (@turbodocx/sdk) from 0.6.1 to 0.8.0, which is what its package.json already declares — the lockfile had drifted. Checked the other five language trees per PATCH_DUTY_CHECKLIST section 3; all current: go-sdk (testify 1.11.1), php-sdk (guzzle ^7.15.2), ruby-sdk (rspec ~3.13), java-sdk (okhttp/gson), py-sdk (httpx>=0.28.1). py-sdk's pytest 8.4.2 / GHSA-6w46-j5rx-g56g stays as-is: requirements-lock.txt documents it as accepted because the patched pytest 9.0.3 needs Python >=3.10 and we still support 3.9. Co-Authored-By: Claude Opus 5 (1M context) --- package-lock.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 5948560f..9e932c94 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3295,9 +3295,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "3.15.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", - "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", + "version": "3.15.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz", + "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==", "dev": true, "license": "MIT", "dependencies": { @@ -4722,7 +4722,7 @@ }, "packages/js-sdk": { "name": "@turbodocx/sdk", - "version": "0.6.1", + "version": "0.8.0", "license": "MIT", "devDependencies": { "@types/jest": "^30.0.0",