Skip to content

chore: ignore GHSA-mh29-5h37-fv8m - #10192

Merged
zkochan merged 1 commit into
mainfrom
gluxon/ignore-GHSA-mh29-5h37-fv8m
Nov 16, 2025
Merged

zkochan merged 1 commit into
mainfrom
gluxon/ignore-GHSA-mh29-5h37-fv8m

Conversation

@gluxon

@gluxon gluxon commented Nov 16, 2025

Copy link
Copy Markdown
Member

The pnpm audit command is failing due to a new security advisory from 2 days ago. The fix relevant for pnpm is tracked in changesets/changesets#1762. We can remove this ignore after once changesets releases a fix.

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ js-yaml has prototype pollution in merge (<<)          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ js-yaml                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.1.1                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.1.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ .>@changesets/cli>@changesets/read>@changesets/        │
│                     │ parse>js-yaml                                          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-mh29-5h37-fv8m      │
└─────────────────────┴────────────────────────────────────────────────────────┘

@gluxon
gluxon marked this pull request as ready for review November 16, 2025 21:00
@gluxon
gluxon requested a review from zkochan as a code owner November 16, 2025 21:00
@zkochan
zkochan merged commit 23b139a into main Nov 16, 2025
@zkochan
zkochan deleted the gluxon/ignore-GHSA-mh29-5h37-fv8m branch November 16, 2025 21:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants