[rush] rush-lib bundles pnpm-sync-lib that pins vulnerable yaml@2.4.1

Open
#5,833 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
nodejs, typescript, yaml
Domain
build-system, security, tooling

Research direction

Start with packages/pnpm-sync-lib/package.json in the linked pnpm-sync repository and verify the exact yaml@2.4.1 pin against GHSA-48c2-rrv3-qjmp. Trace how pnpm-sync-lib enters @microsoft/rush-lib's install-run bootstrap, then determine whether an upstream dependency update is available; done means the Rush dependency chain no longer installs the vulnerable yaml version.

Written by the indexing model from the issue text.

Description

Summary

@microsoft/rush-lib depends on pnpm-sync-lib@0.3.3, which exact-pins yaml@2.4.1. That version is flagged by security scanners / Component Governance under GHSA-48c2-rrv3-qjmp — "yaml is vulnerable to Stack Overflow via deeply nested YAML collections" (Moderate; vulnerable >=2.0.0 <2.8.3, patched >=2.8.3).

Because this yaml is pulled into Rush's install-run bootstrap (common/temp/install-run/@microsoft+rush@<version>/), it cannot be remediated by any consumer-side Rush configuration (details below). It can only be fixed upstream.

The root pin is already tracked at tiktok/pnpm-sync#44, but that issue has been open since 2026-03-26 with no maintainer response, and pnpm-sync appears unmaintained (last commit ~10 months ago). Since @microsoft/rush-lib is the primary consumer of pnpm-sync-lib, raising it here so Rush can drive a resolution.

Dependency chain

yaml@2.4.1
  node_modules/yaml
    yaml@"2.4.1" from pnpm-sync-lib@0.3.3
      node_modules/pnpm-sync-lib
        pnpm-sync-lib@"0.3.3" from @microsoft/rush-lib@<version>
          @microsoft/rush-lib from @microsoft/rush@<version>

pnpm-sync-lib hard-codes "yaml": "2.4.1" (exact, not a range) in every published version up to and including the latest 0.3.3:
https://github.com/tiktok/pnpm-sync/blob/main/packages/pnpm-sync-lib/package.json

Confirmed on @microsoft/rush-lib@5.170.1 and @microsoft/rush-lib@5.175.0; the latest @microsoft/rush-lib@5.176.0 still declares "pnpm-sync-lib": "0.3.3".

Dominant language
TypeScript
Stars
6.5k
Forks
708
Avg merge
5d 7h
Merged PRs (30d)
44

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/rushstack

All issues in microsoft/rushstack

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.