[PR] Update js-yaml development dependencies [thrift]

["kpumuk (via GitHub)" <gi...@apache.org>]

kpumuk opened a new pull request, #3720:
URL: https://github.com/apache/thrift/pull/3720

   <!-- Explain the changes in the pull request below: -->
   
   Dependabot cannot update the two vulnerable `js-yaml` copies in the root lockfile because it treats the transitive `nyc` dependency edge as a conflict. Refresh the lockfile within the existing declared ranges so `nyc` resolves `js-yaml` 3.15.1 and ESLint resolves `js-yaml` 4.3.1.
   
   This keeps `nyc` 15.1.0 and the project's existing Node.js compatibility while addressing these open Dependabot alerts:
   
   - [#290](https://github.com/apache/thrift/security/dependabot/290) and [#291](https://github.com/apache/thrift/security/dependabot/291): YAML merge-key chains can force quadratic CPU consumption ([GHSA-52cp-r559-cp3m](https://github.com/advisories/GHSA-52cp-r559-cp3m), CVE-2026-59869).
   - [#307](https://github.com/apache/thrift/security/dependabot/307) and [#308](https://github.com/apache/thrift/security/dependabot/308): quadratic CPU consumption in `!!omap` resolution ([GHSA-5p4m-2wfm-xmqj](https://github.com/advisories/GHSA-5p4m-2wfm-xmqj)).
   
   <!-- We recommend you review the checklist/tips before submitting a pull request. -->
   
   - [x] Did you create an [Apache Jira](https://issues.apache.org/jira/projects/THRIFT/issues/) ticket?  ([Request account here](https://selfserve.apache.org/jira-account.html), not required for trivial changes) — Skipped for this lockfile-only dependency update.
   - [x] If a ticket exists: Does your pull request title follow the pattern "THRIFT-NNNN: describe my issue"? — No ticket exists.
   - [x] Did you squash your changes to a single commit?  (not required, but preferred)
   - [x] Did you do your best to avoid breaking changes?  If one was needed, did you label the Jira ticket with "Breaking-Change"?
   - [x] If your change does not involve any code, include `[skip ci]` anywhere in the commit message to free up build resources. — Not applicable; CI should validate the updated dependency resolution.
   
   <!--
     The Contributing Guide at:
     https://github.com/apache/thrift/blob/master/CONTRIBUTING.md
     has more details and tips for committing properly.
   -->
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@thrift.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Update js-yaml development dependencies [thrift]

["kpumuk (via GitHub)" <gi...@apache.org>]

kpumuk merged PR #3720:
URL: https://github.com/apache/thrift/pull/3720


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@thrift.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org