Adarshvk98 commented on PR #3993: URL: https://github.com/apache/incubator-kie-tools/pull/3993#issuecomment-5613590847
Thanks @jomarko! I'd suggest going with this PR rather than the Dependabot one, since it covers the CVE on **both major lines**: - **js-yaml 4.x** — the `"js-yaml@^4": "^4.3.2"` workspace override resolves *all* 4.x copies (including the two direct dependencies #3997 bumps) to the patched 4.3.2. - **js-yaml 3.x** — the vulnerable 3.x copies pulled in transitively via `@istanbuljs/load-nyc-config`, `json-refs` and `xmlbuilder2` are only pinned by these workspace overrides (`^3.15.2`). #3997 can't address them, since js-yaml 3.x isn't a direct dependency anywhere — merging it alone would still leave those transitive copies on an affected version. If it helps, #3997 could still land afterwards to keep the two direct `package.json` declarations honest — the only overlap between the PRs is `pnpm-lock.yaml`, which resolves naturally when rebasing on top of the other. I'll resolve the conflicts soon — I'll rebase on `main` and regenerate the lockfile. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
