From b094661a611f941ece27399dbb6df70ae479f587 Mon Sep 17 00:00:00 2001
From: Bruno Luis Goncalves Pedro <brunolgp@inditex.com>
Date: Tue, 22 Sep 2026 14:06:16 +0200
Subject: [PATCH] fix: js-yaml maxtotalmergekeys security issue

---
 example/package-lock.json |  6 +++---
 example/package.json      |  3 +++
 package-lock.json         | 23 -----------------------
 package.json              |  3 ++-
 4 files changed, 8 insertions(+), 27 deletions(-)

diff --git a/example/package-lock.json b/example/package-lock.json
index 5c156a0..608fefe 100644
--- a/example/package-lock.json
+++ b/example/package-lock.json
@@ -3024,9 +3024,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "funding": [
         {
           "type": "github",
diff --git a/example/package.json b/example/package.json
index 98d42c4..5a44d75 100644
--- a/example/package.json
+++ b/example/package.json
@@ -14,6 +14,9 @@
     "@vitejs/plugin-react": "^4.3.4",
     "vite": "^6.0.7"
   },
+  "overrides": {
+    "js-yaml": "^4.3.2"
+  },
   "scripts": {
     "start": "vite",
     "build": "vite build",
diff --git a/package-lock.json b/package-lock.json
index 274fb60..ebb33bc 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8446,29 +8446,6 @@
         "react-dom": ">=16.8.0 <20"
       }
     },
-    "node_modules/swagger-ui-react/node_modules/js-yaml": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/puzrin"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/nodeca"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "argparse": "^2.0.1"
-      },
-      "bin": {
-        "js-yaml": "bin/js-yaml.js"
-      }
-    },
     "node_modules/symbol-tree": {
       "version": "3.2.4",
       "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
diff --git a/package.json b/package.json
index 56901f5..d1ae209 100644
--- a/package.json
+++ b/package.json
@@ -90,7 +90,8 @@
     "vitest": "^4.1.9"
   },
   "overrides": {
-    "esbuild": "^0.28.1"
+    "esbuild": "^0.28.1",
+    "js-yaml": "^4.3.2"
   },
   "publishConfig": {
     "access": "public"