(ofbiz-framework) branch trunk updated: Fixed: Bump js-yaml to 4.3.2 to resolve CVE-2026-84375

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 2f41b9b724 Fixed: Bump js-yaml to 4.3.2 to resolve CVE-2026-84375
2f41b9b724 is described below

commit 2f41b9b724dc5b93cc1433460b6f5496d714bd7f
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Wed Sep 9 16:04:37 2026 +0530

    Fixed: Bump js-yaml to 4.3.2 to resolve CVE-2026-84375
    
    js-yaml 4.0.0-4.3.1 is vulnerable to CVE-2026-84375 (GHSA-2883-xcg3-v3hh): 
maxTotalMergeKeys doesn't count empty mappings in a YAML merge key, letting an 
attacker consume disproportionate CPU with a small document. Bump the 
framework/rest-api override from 4.3.1 to 4.3.2, the version the advisory 
identifies as fixed.
---
 framework/rest-api/package-lock.json | 6 +++---
 framework/rest-api/package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/framework/rest-api/package-lock.json 
b/framework/rest-api/package-lock.json
index a55439b34a..d3b9756c23 100644
--- a/framework/rest-api/package-lock.json
+++ b/framework/rest-api/package-lock.json
@@ -483,9 +483,9 @@
             "license": "MIT"
         },
         "node_modules/js-yaml": {
-            "version": "4.3.1",
-            "resolved": 
"https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz";,
-            "integrity": 
"sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+            "version": "4.3.2",
+            "resolved": 
"https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz";,
+            "integrity": 
"sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
             "funding": [
                 {
                     "type": "github",
diff --git a/framework/rest-api/package.json b/framework/rest-api/package.json
index 2ae27619a1..70ff88aca9 100644
--- a/framework/rest-api/package.json
+++ b/framework/rest-api/package.json
@@ -8,7 +8,7 @@
         "redoc": "2.5.3"
     },
     "overrides": {
-        "js-yaml": "4.3.1",
+        "js-yaml": "4.3.2",
         "minimatch": "10.2.5",
         "brace-expansion": "5.0.9",
         "fast-xml-parser": "5.10.1",