From 71ca8538f738a7b97a37cb24a40b2e4a7929bde9 Mon Sep 17 00:00:00 2001
From: Abner <22141172+Silentely@users.noreply.github.com>
Date: Wed, 22 Jul 2026 18:03:39 +0800
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20security:=20=E9=80=9A=E8=BF=87?=
 =?UTF-8?q?=20overrides=20=E5=8D=87=E7=BA=A7=20js-yaml=20=E4=BF=AE?=
 =?UTF-8?q?=E5=A4=8D=20Dependabot=20=E5=91=8A=E8=AD=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

将传递依赖 js-yaml@3 固定到 3.15.0、js-yaml@4 固定到 4.3.0，
消除 YAML merge-key 二次方复杂度 DoS（#106/#107）。
---
 package-lock.json | 22 ++++++++++++++++------
 package.json      |  4 +++-
 2 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index d745fa7..4952305 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6888,10 +6888,20 @@
       "license": "Python-2.0"
     },
     "node_modules/cosmiconfig/node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmmirror.com/js-yaml/-/js-yaml-4.3.0.tgz",
+      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
       "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
       "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1"
@@ -11887,9 +11897,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "3.14.2",
-      "resolved": "https://registry.npmmirror.com/js-yaml/-/js-yaml-3.14.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
+      "version": "3.15.0",
+      "resolved": "https://registry.npmmirror.com/js-yaml/-/js-yaml-3.15.0.tgz",
+      "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/package.json b/package.json
index e723abc..3ab977c 100644
--- a/package.json
+++ b/package.json
@@ -108,6 +108,8 @@
     "path-to-regexp": "^0.1.13",
     "rollup": "^2.80.0",
     "uuid": "^14.0.0",
-    "ws": "^8.21.0"
+    "ws": "^8.21.0",
+    "js-yaml@3": "3.15.0",
+    "js-yaml@4": "4.3.0"
   }
 }