chore(deps): use 11ty gray-matter fork to resolve js-yaml v3 vulnerabilities#846
chore(deps): use 11ty gray-matter fork to resolve js-yaml v3 vulnerabilities#846ttucker wants to merge 2 commits into
Conversation
Switch from gray-matter to @11ty/gray-matter so the markdown frontmatter parser pulls in the maintained js-yaml 4.x dependency instead of the vulnerable js-yaml 3.x tree. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
|
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
✅ Deploy Preview for histoire-examples-svelte3 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for histoire-controls ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for histoire-site ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for histoire-examples-vue3 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request replaces the gray-matter dependency with @11ty/gray-matter in the packages/histoire package and updates the corresponding import in packages/histoire/src/node/markdown.ts. The lockfile pnpm-lock.yaml has been updated to reflect these dependency changes, including removing unused transitive dependencies. There are no review comments, and we have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
ttucker
changed the title
ttucker
changed the title
1 participant
Maintainers: thank you so much for your hard work on this project. I love Histoire and hope to use it indefinitely!
This PR aims to address the apparently-unmaintained
gray-matterpackage with a maintained fork of it from the good folks at 11ty, which does not use the vulnerable v3.x version ofjs-yamllike the "official" version does. There is some chance that v3.x may be patched eventually, but it is only a matter of time before another vulnerability is found, and this change would seem to avoid that possibility moving forward.Summary
gray-matterwith the 11ty-maintained@11ty/gray-matterpackage to avoid pulling in vulnerablejs-yamlv3gray-matterdependency tree.Why
The legacy
gray-matterpackage pulls in a vulnerablejs-yaml3.x dependency tree. The 11ty-maintained fork usesjs-yaml4.x, resolving the js-yaml vulnerability while preserving the existing frontmatter parsing behavior used by Histoire markdown stories.Currently there are at least two vulnerabilities:
Validation
corepack pnpm install --lockfile-only --frozen-lockfilecorepack pnpm --filter histoire... buildAs this is my first PR to Histoire, please let me know if there are any issues with the PR or the changes and I will be happy to adjust things as needed. If this is not the right approach altogether, again please let me know.
Thanks!