This is an automated email from the ASF dual-hosted git repository. rvesse pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/jena.git
commit 2acbc135f8f42c1fe5ca1208f2e94740a990e617 Author: Øyvind Gjesdal <[email protected]> AuthorDate: Wed Oct 7 22:18:26 2026 +0200 Bump js-yaml from 4.1.1 to 4.3.2 in /jena-fuseki2/jena-fuseki-ui Updated with: yarn up -R js-yaml Fixes two security advisories for dev-dependencies Explanation from Claude: The vulnerable copy comes from @cypress/code-coverage (^4.1.1), a dev dependency. Dependabot could not update it because @istanbuljs/load-nyc-config needs js-yaml ^3.13.1, and it looks for one version for both. Updated with `yarn up -R js-yaml`, which re-resolves each copy within its own range: lockfile only, no resolutions entry. The 3.x copy (3.15.2) is unchanged and already has both fixes. --- jena-fuseki2/jena-fuseki-ui/yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/jena-fuseki2/jena-fuseki-ui/yarn.lock b/jena-fuseki2/jena-fuseki-ui/yarn.lock index ae3749b50e..7a9e391ea5 100644 --- a/jena-fuseki2/jena-fuseki-ui/yarn.lock +++ b/jena-fuseki2/jena-fuseki-ui/yarn.lock @@ -5967,13 +5967,13 @@ __metadata: linkType: hard "js-yaml@npm:^4.1.1": - version: 4.1.1 - resolution: "js-yaml@npm:4.1.1" + version: 4.3.2 + resolution: "js-yaml@npm:4.3.2" dependencies: argparse: "npm:^2.0.1" bin: js-yaml: bin/js-yaml.js - checksum: 10c0/561c7d7088c40a9bb53cc75becbfb1df6ae49b34b5e6e5a81744b14ae8667ec564ad2527709d1a6e7d5e5fa6d483aa0f373a50ad98d42fde368ec4a190d4fae7 + checksum: 10c0/dedd34c2e8fef1d504687f1bc94ed0ee1311a1f78770fa2800352c6d59c635ccf555009d74e9afe529ae62199da2b1ccef30e53dc84dcd8d2d8187c22574bc97 languageName: node linkType: hard
