This is an automated email from the ASF dual-hosted git repository.
FreeAndNil pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/logging-log4net.git
The following commit(s) were added to refs/heads/master by this push:
new 13b52ab9 Pin js-yaml to ^4.3.0 via npm override (#301)
13b52ab9 is described below
commit 13b52ab9b6edab14d32ee24bfeb700541cfd8119
Author: Jan Friedrich <[email protected]>
AuthorDate: Tue Jul 28 16:15:42 2026 +0200
Pin js-yaml to ^4.3.0 via npm override (#301)
https://github.com/apache/logging-log4net/security/dependabot/80
Antora 3.2.0-rc.2 requires js-yaml ~4.2, which excludes the 4.3.0
release that fixes the merge-key quadratic CPU consumption advisory.
No newer Antora is published, so override js-yaml directly.
Docs build verified with the overridden version.
---
package-lock.json | 6 +++---
package.json | 3 +++
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/package-lock.json b/package-lock.json
index 4ba42912..1ae4bfd1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1141,9 +1141,9 @@
}
},
"node_modules/js-yaml": {
- "version": "4.2.0",
- "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz";,
- "integrity":
"sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+ "version": "4.3.0",
+ "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz";,
+ "integrity":
"sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
"dev": true,
"funding": [
{
diff --git a/package.json b/package.json
index 9c3ca627..e8641203 100644
--- a/package.json
+++ b/package.json
@@ -16,5 +16,8 @@
"@antora/cli": "^3.2.0-rc.2",
"@antora/site-generator-default": "^3.2.0-rc.2",
"@asciidoctor/tabs": "^1.0.0-beta.6"
+ },
+ "overrides": {
+ "js-yaml": "^4.3.0"
}
}
