From 6e9d8ca33974aed4c3f76dbebd439efb6912fefa Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 20 Jul 2026 22:04:51 +0000 Subject: [PATCH] fix(ci): bump js-yaml override to 4.3.0 to clear osv-scan GHSA-52cp-r559-cp3m osv-scan started failing after js-yaml 4.2.0 (High 7.5, npm dev dep pulled via the dashboard) entered the OSV database. The fix release is 4.3.0, and package.json already pins js-yaml via an override, so bump the pin and mirror the resolved/integrity in package-lock.json for the single node_modules/js-yaml entry. npm ci --dry-run validates the lockfile Co-authored-by: Krrish Dholakia --- ui/litellm-dashboard/package-lock.json | 6 +++--- ui/litellm-dashboard/package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ui/litellm-dashboard/package-lock.json b/ui/litellm-dashboard/package-lock.json index 91cf705060e..1b9e85e444f 100644 --- a/ui/litellm-dashboard/package-lock.json +++ b/ui/litellm-dashboard/package-lock.json @@ -8513,9 +8513,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, "funding": [ { diff --git a/ui/litellm-dashboard/package.json b/ui/litellm-dashboard/package.json index 7aea571ea8b..223059cf29c 100644 --- a/ui/litellm-dashboard/package.json +++ b/ui/litellm-dashboard/package.json @@ -91,7 +91,7 @@ }, "overrides": { "prismjs": "1.30.0", - "js-yaml": "4.2.0", + "js-yaml": "4.3.0", "glob": "13.0.0", "minimatch": "10.2.4", "ws": "8.21.0",