Security Advisory: js-yaml Prototype Pollution (CVE) used via @changesets/* Dependencies #1762

Hi maintainers 👋

Summary

A recently-flagged security advisory affects the js-yaml dependency used transitively within several @changesets/* packages. All js-yaml versions below 4.1.0 are affected:

Prototype pollution in merge

The dependency chain (via @changesets/[email protected]) looks like this:

@changesets/[email protected]
  |-- @changesets/[email protected]
      |-- @changesets/[email protected]
          |-- [email protected]
  |-- @manypkg/[email protected]
      |-- [email protected]
          |-- [email protected] (deduped)

Attempted Mitigation

I've attempted to override js-yaml in our project to the patched version (4.1.1):

"overrides": {
  "js-yaml": "4.1.1"
},

…but this results in runtime failures when executing changeset version:

npx changeset version

🦋  error Error: could not parse changeset - invalid frontmatter: ---

🦋  error     at Object.parseChangesetFile [as default] (.../node_modules/@changesets/parse/dist/changesets-parse.cjs.js:35:11)
🦋  error     at .../node_modules/@changesets/read/dist/changesets-read.cjs.js:148:71
🦋  error     at async Promise.all (index 0)
🦋  error     at async Object.getChangesets [as default] (.../node_modules/@changesets/read/dist/changesets-read.cjs.js:152:48)
🦋  error     at async version (.../node_modules/@changesets/cli/dist/changesets-cli.cjs.js:1155:34)
🦋  error     at async run (.../node_modules/@changesets/cli/dist/changesets-cli.cjs.js:1339:11)

It appears that @changesets/parse depends on YAML parsing behaviour that changed in [email protected], making the override incompatible.

Environment

• @changesets/cli: 2.29.7
• Node.js: 22.19.0

Request

Would it be possible to update the relevant @changesets/* packages to use js-yaml@^4.1.1, or otherwise confirm whether upgrading is feasible?

Given this is a security advisory (prototype pollution in merge), having a path to a secure version would be very helpful for downstream consumers.

Thanks for maintaining this project 😄