fix: #1845 bump js-yaml

[pmespresso]

Summary

What kind of change does this PR introduce? (check at least one)

• Bugfix
• Feature
• Code style update
• Refactor
• Docs
• Build-related changes
• Other, please describe:

If changing the UI of default theme, please provide the before/after screenshot:

Does this PR introduce a breaking change? (check one)

• Yes
• No

If yes, please describe the impact and migration path for existing applications:

The PR fulfills these requirements:

• When resolving a specific issue, it's referenced in the PR's title (e.g. fix #xxx[,#xxx], where "xxx" is the issue number)

You have tested in the following browsers: (Providing a detailed version will be better.)
It's pretty trivial and the tests pass.

• Chrome
• Firefox
• Safari
• Edge
• IE

If adding a new feature, the PR's description includes:

• A convincing reason for adding this feature
• Related documents have been updated
• Related tests have been updated

To avoid wasting your time, it's best to open a feature request issue first and wait for approval before working on it.

Other information:

[flozero]

Hello ! Thx for PR is there any reason to update to this version ?

[pmespresso]

@f3ltron thanks for the quick response! I raised the issue here. #1845

[pmespresso]

basically:

nodeca/js-yaml#475
Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

nodeca/js-yaml#480
Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.

[kefranabg]

Hi @yjkimjunior,

I don't see any changes on yarn.lock?

[kefranabg]

@yjkimjunior How did you update the yarn.lock? It seems that there is a lot of changes for just one dependency update 🤔

[pmespresso]

@kefranabg
I just bumped the version number in package.json, then rm yarn.lock && yarn

[kefranabg]

Ok, that's what I thought 😉 Doing this is kind of risky. However I made a test by running yarn upgrade js-yaml@latest and it just changed package.json (not yarn.lock) so you can revert your last commit. Sorry for that @yjkimjunior

[vue-bot]

Hey @yjkimjunior, thank you for your time and effort spent on this PR, contributions like yours help make Vue better for everyone. Cheers! 💚