fix: Patch js-yaml security overrides

[jlevy]

A newly published high-severity advisory, GHSA-2883-xcg3-v3hh / CVE-2026-84375, makes the production audit fail for every PR through gray-matter's js-yaml dependency. This updates the existing exact overrides from 3.15.1/4.3.1 to the patched 3.15.2/4.3.2 releases and updates only their lockfile entries.

Supply-chain exception

Both releases were approximately 13.2 days old when reviewed, just inside the repository's 14-day floor. This exception is approved after review and keeps both packages exactly pinned.

• npm registry signatures verify with the same signing key used for the prior versions, and the downloaded SHA-1/SHA-512 values match registry metadata.
• Publisher, maintainers, dependencies, package file lists, binaries, and scripts are unchanged. Neither package has an install lifecycle script.
• The 3.15.2 package matches its Git tag byte-for-byte. All source shipped in 4.3.2 matches its tag; the remaining files are generated distributions whose source maps embed the same tagged source.
• The upstream security PR was merged by a maintainer with a GitHub-verified merge commit. The release/backport commits are unsigned and no Sigstore attestations are published; the package/source correspondence and npm signatures mitigate that residual risk.
• Exploit-shaped merge input accepted by both old versions is rejected by both patched versions. Ordinary YAML merge behavior is unchanged. The intended compatibility change is a hard limit of 100 merge-sequence sources even when the total-merge option is unlimited.

Reviewed-by: Joshua Levy (github.com/jlevy)

Validation

• pnpm audit --prod — no known vulnerabilities
• npm audit signatures — registry signatures verified in isolated 3.x and 4.x installs
• focused YAML/frontmatter suite — 111 tests passed
• pre-push quality gate — formatting, lint, typecheck, action pins, build, package-age check, and all 2,480 tests passed
• installed package contents compared with the reviewed registry tarballs

tbd-jntc tracks the discovered gap that check-package-age.mjs does not yet inspect pnpm.overrides.

Refs: tbd-r82u

[deepsource-io]

DeepSource Code Review

We reviewed changes in c43e2d4...0e5a8a5 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Secrets		Sep 9, 2026 2:07a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[github-actions]

Coverage Report for packages/tbd

Status	Category	Percentage	Covered / Total
🔵	Lines	46.43%	7724 / 16634
🔵	Statements	46.53%	7911 / 17001
🔵	Functions	51.39%	1249 / 2430
🔵	Branches	44.68%	4638 / 10379

File Coverage

No changed files found.

Generated in workflow #1409 for commit 0e5a8a5 by the Vitest Coverage Report Action

[jlevy]

Senior engineering review

Scope

Reviewed PR #280 at the exact layer c43e2d41c245f57a3c9296894ae322269fd7278a..0e5a8a58d29b25e298bb5312c4a7a57ce6ed3558 (main → codex/security-js-yaml-cve-2026-84375): 2 files, 12 additions, 12 deletions. I inspected the manifest and complete lockfile diff, pnpm 10 override semantics and resolved graph, the published npm metadata/integrities for both old and new versions, the upstream tags and backport commits, the advisory and exception record, the release/install boundary, prior PR commentary, and the exact-head CI jobs.

Verdict

Approve. I found no actionable findings. The change is the smallest valid patch: it preserves the two installed major lines, pins each to the exact patched release, updates only the corresponding lockfile records, and leaves the rest of the dependency graph unchanged.

Finding count: 0 Blocker, 0 High, 0 Medium, 0 Low.

Findings

None.

Design assessment

• The official GitHub advisory identifies js-yaml 3.15.2 and 4.3.2 as the patched releases for GHSA-2883-xcg3-v3hh / CVE-2026-84375. The selectors js-yaml@3 and js-yaml@4 are correctly separated, so pnpm does not collapse incompatible major lines.
• The lockfile is internally consistent: its new SHA-512 values match npm registry metadata, all old 3.15.1/4.3.1 package and snapshot references are gone, gray-matter resolves to 3.15.2, and the ESLint toolchain resolves to 4.3.2.
• The repository pins pnpm 10.28.2, where root overrides apply to the full workspace dependency graph. Frozen installs on all CI platforms exercised this exact lockfile.
• The early-release exception is sufficiently documented and human-approved: it names the CVE, uses exact pins, carries a Reviewed-by: sign-off, records the verification performed, and states the residual provenance limits. Independent metadata checks confirmed unchanged publisher/maintainers, dependencies, bin entries, and package scripts; neither release adds a consumer install lifecycle script. Registry gitHead values match the lightweight 3.15.2 and 4.3.2 Git tags, and upstream PR #797 was merged by a maintainer with a GitHub-verified merge commit.
• Release behavior is appropriate. The root override fixes this repository’s reproducible development, CI, and release graph. It is not exported in the get-tbd package manifest, but gray-matter@4.0.3 requests js-yaml@^3.13.1, so a clean downstream resolution selects the patched 3.15.2. Existing downstream lockfiles remain the consumer’s update/audit responsibility, as with any transitive security patch.

Documentation

No repository documentation change is required for this dependency-only security patch. The PR body and commit message contain the durable exception record and compatibility note.

Suggestions

• Follow through on tbd-jntc, which already tracks adding pnpm.overrides and an explicit exception mechanism to check-package-age.mjs. That guard gap predates this patch and does not undermine the exact lockfile or the documented human exception here.

False positives / do not fix

• Do not broaden this PR to repair the package-age checker. The omission is real, disclosed, and separately tracked; coupling that behavior change to an urgent security pin would make this patch harder to land and audit.
• Do not replace both lines with one js-yaml major. gray-matter consumes 3.x while the ESLint toolchain consumes 4.x; the two scoped overrides preserve compatibility.
• Do not treat prepack in 4.3.2 as an install-time execution regression. It is unchanged package-publish behavior, not a consumer preinstall/install/postinstall hook.
• Do not remove the upstream 100-source merge-sequence cap. It is an intentional part of the patched backport. The PR documents the compatibility boundary, and tbd’s production frontmatter wrapper supplies its separate YAML engine to gray-matter.

CI status

All 7/7 current checks pass at exact head 0e5a8a58d29b25e298bb5312c4a7a57ce6ed3558: Benchmark, Coverage & Lint, DeepSource Secrets, macOS/Node 24, Ubuntu/Node 22.12, Ubuntu/Node 24, and Windows/Node 24. The successful Coverage & Lint job includes pnpm install --frozen-lockfile, pnpm audit --prod, formatting, lint/typecheck, build, publint, and coverage.

Primary references: GitHub advisory, upstream security PR, and pnpm 10 override documentation.

[jlevy]

Review disposition

Addressed the senior review at 0e5a8a58d29b25e298bb5312c4a7a57ce6ed3558:

• Findings: none. The formal-review, inline-comment, PR-comment, cross-linked-issue, and linked review-doc channels contain no unaddressed actionable finding.
• Suggestion: retained as tbd-jntc - package-age enforcement for pnpm.overrides and an explicit exception mechanism remain separately tracked. Per the review's explicit disposition, this security patch is not broadened to include that work.
• Code: no change was required.
• Verification: the PR remains open, clean, and mergeable at exact head 0e5a8a58d29b25e298bb5312c4a7a57ce6ed3558; all 7/7 GitHub checks pass.