You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kie.apache.org by "AnnJoy23 (via GitHub)" <gi...@apache.org> on 2026/05/07 09:05:31 UTC
[PR] NO-ISSUE : BUMP YAML VERSION [incubator-kie-tools]
AnnJoy23 opened a new pull request, #3562:
URL: https://github.com/apache/incubator-kie-tools/pull/3562
fix CVE-2026-33532
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] NO-ISSUE : BUMP YAML VERSION [incubator-kie-tools]
Posted by "thiagoelg (via GitHub)" <gi...@apache.org>.
thiagoelg commented on code in PR #3562:
URL: https://github.com/apache/incubator-kie-tools/pull/3562#discussion_r3201871497
##########
pnpm-workspace.yaml:
##########
@@ -25,3 +25,8 @@ overrides:
# CVE-2026-1526, CVE-2026-2229, CVE-2026-1528, CVE-2026-1527, CVE-2026-1525, CVE-2026-2203: Fix security vulnerability in undici
# Waiting for @openapi-contrib/openapi-schema-to-json-schema to release patched version
"undici": "^6.24.0"
+ # CVE-2026-33532: Fix security vulnerability in yaml
+ # Override cosmiconfig>yaml@1.10.2 with patched version 1.10.3
+ "cosmiconfig>yaml": "1.10.3"
+ # Override yaml@^2 (including yaml-language-server yaml@2.0.0-11) used by helm charts, monaco-yaml, vite, and langchain dependencies with patched version 2.8.3
+ "yaml@^2": "^2.8.3"
Review Comment:
These comments do not follow the [guidelines](https://github.com/apache/incubator-kie-tools/blob/main/repo/DEPENDENCY_MANAGEMENT.md).
---
- `cosmiconfig` is the dependency of what modules? Can these modules be updated? Also, if you check the lockfile, it's already using version `1.10.3`, so this override is not needed.
- All `yaml` entries in the lockfile for version 2+ are already using `^2.8.3`; this override is also not needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] NO-ISSUE : BUMP YAML VERSION [incubator-kie-tools]
Posted by "thiagoelg (via GitHub)" <gi...@apache.org>.
thiagoelg commented on code in PR #3562:
URL: https://github.com/apache/incubator-kie-tools/pull/3562#discussion_r3201938468
##########
pnpm-lock.yaml:
##########
Review Comment:
Except for the first few lines, all other changes to the lockfile are unrelated to the overrides. Is there something different in your environment? Are you using the Devbox setup?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] NO-ISSUE : BUMP YAML VERSION [incubator-kie-tools]
Posted by "AnnJoy23 (via GitHub)" <gi...@apache.org>.
AnnJoy23 commented on PR #3562:
URL: https://github.com/apache/incubator-kie-tools/pull/3562#issuecomment-4409016708
closing the PR as yaml updated in lock file
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] NO-ISSUE : BUMP YAML VERSION [incubator-kie-tools]
Posted by "AnnJoy23 (via GitHub)" <gi...@apache.org>.
AnnJoy23 closed pull request #3562: NO-ISSUE : BUMP YAML VERSION
URL: https://github.com/apache/incubator-kie-tools/pull/3562
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org