build(deps): bump the nestjs group across 1 directory with 5 updates - #2897
Open
dependabot[bot] wants to merge 1 commit into
Open
build(deps): bump the nestjs group across 1 directory with 5 updates#2897dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 security issue
Security issues:
- js-yaml: Denial of Service via exponential parsing in flow collections (link)
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="package-lock.json" line_range="3166-3187" />
<code_context>
</code_context>
<issue_to_address>
**security (CVE-2026-73643):** js-yaml: Denial of Service via exponential parsing in flow collections
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.
*Source: trivy*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
3166
to
3187
| "node_modules/@nestjs/swagger/node_modules/js-yaml": { | ||
| "version": "4.1.1", | ||
| "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", | ||
| "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", | ||
| "version": "5.2.1", | ||
| "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.1.tgz", | ||
| "integrity": "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==", | ||
| "funding": [ | ||
| { | ||
| "type": "github", | ||
| "url": "https://github.com/sponsors/puzrin" | ||
| }, | ||
| { | ||
| "type": "github", | ||
| "url": "https://github.com/sponsors/nodeca" | ||
| } | ||
| ], | ||
| "license": "MIT", | ||
| "dependencies": { | ||
| "argparse": "^2.0.1" | ||
| }, | ||
| "bin": { | ||
| "js-yaml": "bin/js-yaml.js" | ||
| "js-yaml": "bin/js-yaml.mjs" | ||
| } | ||
| }, |
There was a problem hiding this comment.
security (CVE-2026-73643): js-yaml: Denial of Service via exponential parsing in flow collections
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.
Source: trivy
Bumps the nestjs group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@nestjs-modules/mailer](https://github.com/nest-modules/mailer) | `2.3.4` | `2.3.7` | | [@nestjs/platform-express](https://github.com/nestjs/nest/tree/HEAD/packages/platform-express) | `11.1.28` | `11.2.1` | | [@nestjs/swagger](https://github.com/nestjs/swagger) | `11.4.2` | `11.4.7` | | [@nestjs/cli](https://github.com/nestjs/nest-cli) | `11.0.21` | `11.0.24` | | [@nestjs/testing](https://github.com/nestjs/nest/tree/HEAD/packages/testing) | `11.1.19` | `11.2.1` | Updates `@nestjs-modules/mailer` from 2.3.4 to 2.3.7 - [Release notes](https://github.com/nest-modules/mailer/releases) - [Commits](https://github.com/nest-modules/mailer/compare/@nestjs-modules/mailer@2.3.4...@nestjs-modules/mailer@2.3.7) Updates `@nestjs/platform-express` from 11.1.28 to 11.2.1 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.2.1/packages/platform-express) Updates `@nestjs/swagger` from 11.4.2 to 11.4.7 - [Release notes](https://github.com/nestjs/swagger/releases) - [Commits](nestjs/swagger@11.4.2...11.4.7) Updates `@nestjs/cli` from 11.0.21 to 11.0.24 - [Release notes](https://github.com/nestjs/nest-cli/releases) - [Commits](nestjs/nest-cli@11.0.21...11.0.24) Updates `@nestjs/testing` from 11.1.19 to 11.2.1 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.2.1/packages/testing) --- updated-dependencies: - dependency-name: "@nestjs-modules/mailer" dependency-version: 2.3.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nestjs - dependency-name: "@nestjs/cli" dependency-version: 11.0.24 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: nestjs - dependency-name: "@nestjs/platform-express" dependency-version: 11.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nestjs - dependency-name: "@nestjs/swagger" dependency-version: 11.4.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nestjs - dependency-name: "@nestjs/testing" dependency-version: 11.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: nestjs ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/nestjs-93cdd3c202
branch
from
August 24, 2026 15:03
692fbfc to
6a2f23f
Compare
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the nestjs group with 5 updates in the / directory:
2.3.42.3.711.1.2811.2.111.4.211.4.711.0.2111.0.2411.1.1911.2.1Updates
@nestjs-modules/mailerfrom 2.3.4 to 2.3.7Release notes
Sourced from @nestjs-modules/mailer's releases.
Commits
747db09chore(release): version packages (#1314)3d92210fix(mailer): mjml v5 promise, queue global option, export TransportType (#1313)3f5932bchore(release): version packages (#1305)b487484fix(security): patch remaining Dependabot alerts across monorepo (#1304)a1f3c42chore(release): version packages (#1303)0c5ed1dfix(security): update vulnerable dependencies to patched versions (#1302)Updates
@nestjs/platform-expressfrom 11.1.28 to 11.2.1Release notes
Sourced from @nestjs/platform-express's releases.
... (truncated)
Commits
4535f43chore(release): publish v11.2.1 releasef2a7e4bchore(release): publish v11.2.0 release03587a1chore(release): publish v11.1.29 release4e4f8f0Merge pull request #17421 from Se3do/fix/express-multer-limit-field-nesting2a532e7chore: fix misspelled spec filenames4a40978fix(express): map missing multer field nesting error7285778chore: update multerExceptions constant92bc05dchore: update readmeUpdates
@nestjs/swaggerfrom 11.4.2 to 11.4.7Release notes
Sourced from @nestjs/swagger's releases.
... (truncated)
Commits
77e3d46chore(): release v11.4.7782cdc0Merge pull request #4056 from nestjs/renovate/js-yaml-5.x-lockfile4a5a4b0Merge pull request #4005 from y-hsgw/fix/plugin-object-example11b3fb6chore(deps): update dependency js-yaml to v5.3.0e5203bfMerge pull request #4019 from kyungseopk1m/fix/readonly-outdir-import-pathfccfa59Merge pull request #4030 from kyungseopk1m/fix/deep-partial-type-plugin-metadata91e5917Merge pull request #4047 from kyungseopk1m/feat/api-header-extensions1296583Merge pull request #4053 from nestjs/renovate/js-yaml-5.xf436f56Merge pull request #4054 from nestjs/renovate/fastify-static-10.xb293944Merge pull request #4042 from jorenl/bugfix/plugin-get-identifier-from-name-p...Updates
@nestjs/clifrom 11.0.21 to 11.0.24Release notes
Sourced from @nestjs/cli's releases.
Commits
c8a68dachore(): release v11.0.24e5fda8cMerge pull request #3478 from ruban-s/fix/typescript-7-unsupported-api3c6b4acfix(compiler): fail fast when typescript lacks the programmatic apide85434Merge pull request #3475 from abdulganiyy/refactor/move-languages-variable-cl...1697b7frefactor: move available languages closer to first usage2705bd4Merge pull request #3472 from abdulganiyy/delete-unused-helper-file75b57c4refactor: delete unused gulp tool utility helper filec2aefdfMerge pull request #3469 from iamkanguk97/fix/runner-duplicated-binary54b08aefix(runners): remove duplicated binary in failed command message731a09bchore(): release v11.0.23Updates
@nestjs/testingfrom 11.1.19 to 11.2.1Release notes
Sourced from @nestjs/testing's releases.
... (truncated)
Commits
4535f43chore(release): publish v11.2.1 releasef2a7e4bchore(release): publish v11.2.0 release03587a1chore(release): publish v11.1.29 release92bc05dchore: update readmedfaa376chore(release): publish v11.1.28 release660a124chore(release): publish v11.1.27 releaseaa5c4f1chore: update readme and package.json9ff83d5chore(release): publish v11.1.26 release02f8041chore(release): publish v11.1.25 released8a0ab8chore(release): publish v11.1.24 release