fix(textlint): raise peer range to pull in patched linter-formatter - #171
Merged
Conversation
textlint 15.8.0 bumped @textlint/linter-formatter's own js-yaml dependency to ^4.3.0, closing the merge-key DoS (GHSA-52cp-r559-cp3m / CVE-2026-59869) for that path without needing a pnpm override. Note: this doesn't fully close Dependabot alert #19 — js-yaml@4.2.0 is still reachable via @vscode/vsce -> secretlint@10.2.2 -> rc-config-loader, which has no upstream fix available yet.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@mermaid-lint/textlint'stextlintpeerDependency range from>=13.0.0to>=15.8.0.@textlint/linter-formatter@15.8.0bumped its ownjs-yamldependency to^4.3.0, which patches the merge-key quadratic-CPU DoS (GHSA-52cp-r559-cp3m / CVE-2026-59869) for thetextlint→@textlint/linter-formatterpath — no override needed, just a version bump.textlint@15.8.0tree no longer pulls in its optional@modelcontextprotocol/sdkintegration (express/hono/cors/jose/zod/etc.), which we never used directly — that's most of this diff's size.Not fully closing the alert
This is the "upgrade what's feasible" half of Dependabot alert #19, not the whole fix.
js-yaml@4.2.0is still reachable via a second, independent path:mermaid-lint-vscode→@vscode/vsce@3.9.2→secretlint@10.2.2→rc-config-loader@4.1.4(js-yaml ^4.1.1)@vscode/vsceis already on its latest release and hard-pinssecretlint: ^10.1.2; secretlint's latest (13.0.4) is a major jump vsce doesn't support yet, andrc-config-loader@4.1.4(also latest) still declaresjs-yaml ^4.1.1. No upstream release closes that path today — it'll need apnpm.overridesentry or a future vsce/secretlint release.Test plan
pnpm -r build— all 8 workspace packages build cleanpnpm test— 1223 tests passrtk proxy pnpm biome check— clean🤖 Generated with Claude Code