Tags: kiali/kiali
Tags
[v2.27] CVE-2026-59877: Upgrade protobufjs to 7.6.5 (#10101) Bump the protobufjs resolution from ^7.5.6 to ^7.6.5 to address CVE-2026-59877 (Denial of Service via crafted .proto schema). Backport of #10100 to v2.27. Co-authored-by: Cursor <cursoragent@cursor.com>
[v2.22] CVE-2026-59877: Upgrade protobufjs to 7.6.5 (#10102) Add protobufjs ^7.6.5 resolution to address CVE-2026-59877 (Denial of Service via crafted .proto schema). Backport of #10100 to v2.22. Co-authored-by: Cursor <cursoragent@cursor.com>
CVE-2026-59869: Upgrade js-yaml to 4.3.0 / 3.15.0 [v2.17] (#10035) * CVE-2026-59869: Upgrade js-yaml to 4.3.0 / 3.15.0 Backport of #10031 to v2.17. Upgrade js-yaml from 4.1.0 to 4.3.0 and transitive 3.14.0 to 3.15.0 to fix CVE-2026-59869, a Denial of Service vulnerability via crafted YAML documents using merge keys. Co-authored-by: Cursor <cursoragent@cursor.com> * CVE-2026-59869: Force js-yaml 3.x to 3.15.0 and 4.x to 4.3.0 Add yarn resolutions so all js-yaml descriptors (including the exact 3.14.0 pin from xmlbuilder2 and caret ranges) resolve to the fixed versions required by the CVE. Co-authored-by: Cursor <cursoragent@cursor.com> * Remove redundant caret-range resolutions Keep only the exact-pin resolution for js-yaml@3.14.0 and rely on yarn dedupe for caret ranges. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Jay Shaughnessy <jshaughn@jshaughn-thinkpadp1gen4i.rmtusnj.csb> Co-authored-by: Cursor <cursoragent@cursor.com>
CVE-2026-59869: Upgrade js-yaml to 4.3.0 / 3.15.0 [v2.11] (#10036) * CVE-2026-59869: Upgrade js-yaml to 4.3.0 / 3.15.0 Backport of #10031 to v2.11. Upgrade js-yaml from 4.1.0 to 4.3.0 and transitive 3.14.0 to 3.15.0 to fix CVE-2026-59869, a Denial of Service vulnerability via crafted YAML documents using merge keys. Co-authored-by: Cursor <cursoragent@cursor.com> * CVE-2026-59869: Force js-yaml 3.x to 3.15.0 and 4.x to 4.3.0 Add yarn resolutions so all js-yaml descriptors (including the exact 3.14.0 pin from xmlbuilder2 and caret ranges) resolve to the fixed versions required by the CVE. Co-authored-by: Cursor <cursoragent@cursor.com> * Remove redundant caret-range resolutions Keep only the exact-pin resolution for js-yaml@3.14.0 and rely on yarn dedupe for caret ranges. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Jay Shaughnessy <jshaughn@jshaughn-thinkpadp1gen4i.rmtusnj.csb> Co-authored-by: Cursor <cursoragent@cursor.com>
PreviousNext