From aea0b8480024193775ad492c37ea6a67e1269b50 Mon Sep 17 00:00:00 2001 From: Vedansh Vijaywargiya Date: Tue, 28 Jul 2026 21:43:09 +0530 Subject: [PATCH] AAP-20502: patch js-yaml merge-key DoS (GHSA-52cp-r559-cp3m) in android/ and ios/ Bumps all three vulnerable js-yaml copies in each lockfile to patched versions, using major-bounded overrides so the 3.x consumers stay on the 3.x API: node_modules/js-yaml 4.1.1 -> 4.3.0 @istanbuljs/load-nyc-config/node_modules/js-yaml 3.14.2 -> 3.15.0 js-yaml-cloudformation-schema/node_modules/js-yaml 3.14.2 -> 3.15.0 Co-Authored-By: Claude Opus 5 (1M context) --- android/package-lock.json | 28 +++++++++++++++++++--------- android/package.json | 9 ++++++++- ios/package-lock.json | 30 ++++++++++++++++++++---------- ios/package.json | 9 ++++++++- 4 files changed, 55 insertions(+), 21 deletions(-) diff --git a/android/package-lock.json b/android/package-lock.json index d9094bd..1ca7921 100644 --- a/android/package-lock.json +++ b/android/package-lock.json @@ -647,9 +647,9 @@ } }, "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "dev": true, "license": "MIT", "dependencies": { @@ -5618,10 +5618,20 @@ "dev": true }, "node_modules/js-yaml": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", - "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], "license": "MIT", "dependencies": { "argparse": "^2.0.1" @@ -5649,9 +5659,9 @@ } }, "node_modules/js-yaml-cloudformation-schema/node_modules/js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "dev": true, "license": "MIT", "dependencies": { diff --git a/android/package.json b/android/package.json index fc97c88..666baf0 100644 --- a/android/package.json +++ b/android/package.json @@ -30,6 +30,13 @@ }, "overrides": { "minimatch": ">=3.1.3", - "form-data": ">=4.0.6" + "form-data": ">=4.0.6", + "js-yaml": "^4.3.0", + "@istanbuljs/load-nyc-config": { + "js-yaml": "^3.15.0" + }, + "js-yaml-cloudformation-schema": { + "js-yaml": "^3.15.0" + } } } diff --git a/ios/package-lock.json b/ios/package-lock.json index 95ba6d6..8179c14 100644 --- a/ios/package-lock.json +++ b/ios/package-lock.json @@ -16,7 +16,7 @@ }, "devDependencies": { "@types/jest": "^27.4.0", - "browserstack-node-sdk": "*", + "browserstack-node-sdk": "latest", "jest": "^27.4.7" } }, @@ -647,9 +647,9 @@ } }, "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "dev": true, "license": "MIT", "dependencies": { @@ -5632,10 +5632,20 @@ "dev": true }, "node_modules/js-yaml": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", - "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], "license": "MIT", "dependencies": { "argparse": "^2.0.1" @@ -5663,9 +5673,9 @@ } }, "node_modules/js-yaml-cloudformation-schema/node_modules/js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "dev": true, "license": "MIT", "dependencies": { diff --git a/ios/package.json b/ios/package.json index e738a2b..25be0e8 100644 --- a/ios/package.json +++ b/ios/package.json @@ -29,6 +29,13 @@ "postinstall": "npm update browserstack-node-sdk" }, "overrides": { - "minimatch": ">=3.1.3" + "minimatch": ">=3.1.3", + "js-yaml": "^4.3.0", + "@istanbuljs/load-nyc-config": { + "js-yaml": "^3.15.0" + }, + "js-yaml-cloudformation-schema": { + "js-yaml": "^3.15.0" + } } }