build(deps): bump js-yaml to 4.2.0 and shell-quote to 1.8.4 - #1037
Merged
decyjphr merged 1 commit intoJul 27, 2026
Conversation
Backport the applicable dependency bumps from PR #1001 onto yadhav/fix-recent-issues. Only js-yaml (^4.1.0 -> 4.2.0, direct prod dep, includes DoS fix) and shell-quote (^1.6.1 via npm-run-all -> 1.8.4) are applied; qs cannot be bumped to 6.15.2 on this branch because express 4.21.2 / body-parser 1.20.3 pin qs to exactly 6.13.0. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1d1ba9d4-e6ec-44ae-8432-3eee74d26b82
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pulls the safe, in-range dependency bumps from #1001 into
yadhav/fix-recent-issues. Lock-file only — no manifest or source changes.^4.1.0allows it. Includes a DoS security fix.npm-run-all(^1.6.1); range allows it.What is intentionally not included
The third bump from #1001 — qs 6.13.0 → 6.15.2 — is excluded. qs is hard-pinned to 6.13.0 by
express 4.21.2/body-parser 1.20.3, and qs 6.15.x is only reachable throughbody-parser 2.x ← express 5.x ← probot 14.x. That means qs requires a full probot 13 → 14 major upgrade (which also requires Node 22+, ESM/octokit changes, and a codebase-widegithub.rest.*migration). That upgrade is being tracked/decided separately and is out of scope for this PR.Validation
git difflimited topackage-lock.jsononly.npx jestunit suites).Pre-existing lint errors and integration-test failures on the base branch are unaffected by this change (identical source).