Npm audit js-yaml HIgh vulnerability

[ghost]

High	Code Injection
Package	js-yaml
Dependency of	jest
Path	jest > jest-cli > @jest/core > @jest/reporters > istanbul-api > js-yaml
More info	https://npmjs.com/advisories/813

[SimenB]

Report it to istanbul, this is transitive for jest (but note that istanbul-api is gonna be deprecated (istanbuljs/istanbuljs#321))

[coreyfarrell]

Also note that istanbul-api depends on js-yaml ^3.13.0 which allows the non-vulnerable version to be installed so the issue is likely that your package-lock.json or yarn.lock needs to be regenerated.

[ghost]

Okay, thank you.

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.
Please note this issue tracker is not a help forum. We recommend using StackOverflow or our discord channel for questions.