From b733780e5a412949e2fef1b4170cc1b699a31124 Mon Sep 17 00:00:00 2001 From: sec-check Date: Tue, 8 Sep 2026 22:17:02 -0400 Subject: [PATCH] [sec-check] fix: bump discord js-yaml 4.3.1 -> 4.3.2 (GHSA-2883-xcg3-v3hh) CPU-exhaustion via empty merge sources (CWE-400/407, CVSS 7.5). Patch bump on the same 4.x line; npm audit now clean, yaml.load smoke-tested against discord/lib/config.js usage. Refs #6335 Signed-off-by: sec-check --- discord/package-lock.json | 8 ++++---- discord/package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/discord/package-lock.json b/discord/package-lock.json index 413242c46..5773b94b9 100644 --- a/discord/package-lock.json +++ b/discord/package-lock.json @@ -9,7 +9,7 @@ "version": "1.0.0", "dependencies": { "discord.js": "^14.16.0", - "js-yaml": "^4.3.1" + "js-yaml": "^4.3.2" } }, "node_modules/@discordjs/builders": { @@ -252,9 +252,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", - "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "funding": [ { "type": "github", diff --git a/discord/package.json b/discord/package.json index 057f75325..1eccf4cf3 100644 --- a/discord/package.json +++ b/discord/package.json @@ -8,6 +8,6 @@ }, "dependencies": { "discord.js": "^14.16.0", - "js-yaml": "^4.3.1" + "js-yaml": "^4.3.2" } }