fix(deps): 🛡️ update js-yaml to 4.1.1 to address CVE-2025-64718 (#4959)
# Description of Changes This pull request updates several development dependencies in `devTools/package.json` and `devTools/package-lock.json` to resolve a security vulnerability affecting `js-yaml` versions `<4.1.1`. The key change is upgrading `js-yaml` from `4.1.0` to the patched version `4.1.1`, which mitigates a prototype pollution vulnerability (CVE-2025-64718). Additional related dependencies were upgraded to ensure compatibility with the updated toolchain, including `stylelint`, `@stylistic/stylelint-plugin`, and `stylelint-config-standard`. These updates were necessary because the older versions required the vulnerable dependency and blocked Dependabot from applying the patch. **What was changed** - Updated `js-yaml` to `4.1.1` (security fix) - Updated `stylelint`, `@stylistic/stylelint-plugin`, `stylelint-config-standard`, and several transitive dependencies - Updated `package-lock.json` to reflect these changes **Why the change was made** - To resolve CVE-2025-64718, which allows prototype pollution when parsing YAML - To unblock Dependabot updates that were previously incompatible due to dependency constraints --- ## Checklist ### General - [x] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md) - [x] I have read the [Stirling-PDF Developer Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md) (if applicable) - [ ] I have read the [How to add new languages to Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md) (if applicable) - [x] I have performed a self-review of my own code - [x] My changes generate no new warnings ### Documentation - [ ] I have updated relevant docs on [Stirling-PDF's doc repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/) (if functionality has heavily changed) - [ ] I have read the section [Add New Translation Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags) (for new translation tags only) ### Translations (if applicable) - [ ] I ran [`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md) ### UI Changes (if applicable) - [ ] Screenshots or videos demonstrating the UI changes are attached (e.g., as comments or direct attachments in the PR) ### Testing (if applicable) - [ ] I have tested my changes locally. Refer to the [Testing Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing) for more details.
This commit is contained in:
@@ -6,8 +6,8 @@
|
||||
"lint:css:fix": "stylelint \"../app/core/src/main/**/*.css\" \"../app/proprietary/src/main/resources/static/css/*.css\" --config .stylelintrc.json --fix"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@stylistic/stylelint-plugin": "^3.1.3",
|
||||
"stylelint": "^16.21.1",
|
||||
"stylelint-config-standard": "^38.0.0"
|
||||
"@stylistic/stylelint-plugin": "^4.0.0",
|
||||
"stylelint": "^16.26.0",
|
||||
"stylelint-config-standard": "^39.0.1"
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user