From 7f588eb94ee99886d57aaa0e0550a035a6a3794d Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Fri, 7 Aug 2026 08:48:42 +0000 Subject: [PATCH 1/4] chore: upgrade js-yaml to ^4.3.1 to address GHSA-5p4m-2wfm-xmqj Co-Authored-By: Claude Opus 5 (1M context) --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 43667db86..614bd2005 100644 --- a/yarn.lock +++ b/yarn.lock @@ -16615,13 +16615,13 @@ __metadata: linkType: hard "js-yaml@npm:^4.1.1": - version: 4.3.0 - resolution: "js-yaml@npm:4.3.0" + version: 4.3.1 + resolution: "js-yaml@npm:4.3.1" dependencies: argparse: "npm:^2.0.1" bin: js-yaml: bin/js-yaml.js - checksum: 10c0/058b30473d6915ca5b4feb11e2f7d4d97242f98d00a798ed48dd90b46b7c640398afe9128c5db22c5300f8c6528fe2a174b9a93f351a70ebc28c6203938d8bff + checksum: 10c0/13c500ca322e0c3f8c81686e6ecda96d2ea37b45247a420c17c7db36932d6965cc27391abc2d1a104501600e7f0d947a5f8b7be6db619c4fefa87901b3512807 languageName: node linkType: hard From 1675110aa84d2e71bb5a3efd5fc43bc1032b7275 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Fri, 7 Aug 2026 08:49:16 +0000 Subject: [PATCH 2/4] chore: add CHANGELOG entry for js-yaml upgrade Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index af7ccdb7c..1be2ef02b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -26,6 +26,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Upgraded `fast-uri` to `^3.1.5`. [#1541](https://github.com/sourcebot-dev/sourcebot/pull/1541) - Upgraded `ip-address` to `^10.4.0`. [#1540](https://github.com/sourcebot-dev/sourcebot/pull/1540) - [EE] Fixed Ask MCP connector tools failing to load when their input schemas use JSON Schema 2019-09 or 2020-12. [#1547](https://github.com/sourcebot-dev/sourcebot/pull/1547) +- Upgraded `js-yaml` to `^4.3.1`. [#1552](https://github.com/sourcebot-dev/sourcebot/pull/1552) ## [5.1.5] - 2026-07-31 From a0f1f95c50db9f9976e5d979a4515b22fac183eb Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 12:37:13 +0000 Subject: [PATCH 3/4] chore: upgrade js-yaml to 4.3.2 to address CVE-2026-84375 Refreshes the yarn.lock entry for js-yaml. The existing `^4.1.1` resolution range already admits the patched 4.3.2 release, so no package.json change is required. Co-Authored-By: Claude Opus 5 (1M context) --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 79411d328..1acacaa34 100644 --- a/yarn.lock +++ b/yarn.lock @@ -16473,13 +16473,13 @@ __metadata: linkType: hard "js-yaml@npm:^4.1.1": - version: 4.3.1 - resolution: "js-yaml@npm:4.3.1" + version: 4.3.2 + resolution: "js-yaml@npm:4.3.2" dependencies: argparse: "npm:^2.0.1" bin: js-yaml: bin/js-yaml.js - checksum: 10c0/13c500ca322e0c3f8c81686e6ecda96d2ea37b45247a420c17c7db36932d6965cc27391abc2d1a104501600e7f0d947a5f8b7be6db619c4fefa87901b3512807 + checksum: 10c0/dedd34c2e8fef1d504687f1bc94ed0ee1311a1f78770fa2800352c6d59c635ccf555009d74e9afe529ae62199da2b1ccef30e53dc84dcd8d2d8187c22574bc97 languageName: node linkType: hard From 9a829c516f41fe8b11b71eb097ff19129725e9d5 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 12:38:24 +0000 Subject: [PATCH 4/4] chore: add CHANGELOG entry for js-yaml upgrade Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index dc58dad64..b24d69d8b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -18,6 +18,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Upgraded `postcss-selector-parser` to `^6.1.4`. [#1625](https://github.com/sourcebot-dev/sourcebot/pull/1625) - Upgraded `fast-uri` to `3.1.7`. [#1626](https://github.com/sourcebot-dev/sourcebot/pull/1626) - Upgraded `qs` to `6.16.0`. [#1627](https://github.com/sourcebot-dev/sourcebot/pull/1627) +- Upgraded `js-yaml` to `4.3.2`. [#1636](https://github.com/sourcebot-dev/sourcebot/pull/1636) ## [5.1.10] - 2026-08-27