Latest openapi-typescript pulls vulnerable js-yaml via archived @redocly/openapi-core 1.x

[grishaMelisov]

openapi-typescript version

7.13.0

Node.js version

v24.11.1

OS + version

macOS 15.6

Description

Summary

pnpm audit --audit-level=high fails when using the latest openapi-typescript.

The latest version (7.13.0) depends on:

openapi-typescript
└── @redocly/openapi-core ^1.34.6
    └── js-yaml 4.2.0

js-yaml 4.2.0 is now reported as vulnerable (GHSA-52cp-r559-cp3m), causing CI to fail even though all direct dependencies are up to date.

Steps to reproduce

Install the latest version:

pnpm add -D openapi-typescript@latest

Run:

pnpm audit --audit-level=high

Actual result

Audit reports:

High severity vulnerability

Package: js-yaml
Affected versions: >=4.0.0 <4.3.0
Patched version: >=4.3.0

Dependency path:

openapi-typescript
→ @redocly/openapi-core
→ js-yaml

Expected result

The latest openapi-typescript should not pull a dependency with a known high-severity vulnerability.

Additional information

Current versions:

openapi-typescript 7.13.0
@redocly/openapi-core 1.34.17

It looks like openapi-typescript still depends on the archived @redocly/openapi-core 1.x branch, while the actively maintained branch is now 2.x.

Is there a planned update, or is using pnpm.overrides currently the recommended workaround?

Reproduction

1. Install the latest version of openapi-typescript.

pnpm add -D openapi-typescript@latest

2. Run:

pnpm audit --audit-level=high

3. Audit reports a high severity vulnerability coming from the dependency chain:

openapi-typescript
→ @redocly/openapi-core
→ js-yaml

Current resolved versions:

openapi-typescript 7.13.0
@redocly/openapi-core 1.34.17
js-yaml 4.2.0

js-yaml 4.2.0 is reported as vulnerable (GHSA-52cp-r559-cp3m).

The issue reproduces on a clean install and is independent of the project itself.

Expected result

The latest openapi-typescript should not resolve to a dependency tree containing a known high-severity vulnerability.

Ideally the package should either:

• update to a maintained version of @redocly/openapi-core, or
• otherwise avoid pulling js-yaml <4.3.0.

At the moment the only apparent workaround is using pnpm.overrides, which ideally should not be necessary when using the latest released version.

Required

• My OpenAPI schema is valid and passes the Redocly validator (npx @redocly/cli@latest lint)

Extra

• I’m willing to open a PR (see CONTRIBUTING.md)

[Ballpin]

I created some patches that will work with pnpm. When i tested them through the package there where 2 rules in osa3 that failed. The rules that failed was something with mediatype, The rest worked.

Tested them carefully and ran a scan on it. Might be a temporary solution.

What i used in the project during the test

• NodeJS 24
• Typescript 6
• MacOS

How to add them

1. In your pnpm-workspace.yaml add these lines. This will override your older versions of js-yaml and apply patches during install. (They are lower down in the instructions).

# You can override js-yaml completely if you want.
overrides:
  "js-yaml@>=4.0.0 <4.3.0": "4.3.0"
  "js-yaml@>=4.0.0 <=4.1.1": "4.2.0"

patchedDependencies:
  "@redocly/openapi-core@1.34.17": patches/@redocly__openapi-core@1.34.17.patch
  openapi-typescript@7.13.0: patches/openapi-typescript@7.13.0.patch

2. Create a folder named patches in your project root. Then add these patch files, the file names and content needs to be exactly as written below.

File: @redocly__openapi-core@1.34.17.patch

diff --git a/lib/js-yaml/index.d.ts b/lib/js-yaml/index.d.ts
deleted file mode 100644
index ff76f9938928da3bf43a26c1a36129bfb29641e9..0000000000000000000000000000000000000000
diff --git a/lib/js-yaml/index.js b/lib/js-yaml/index.js
index 00988f22e02017be0cae16387b2354288948f414..03b529a54e11de3d83a393b51dbca00a30bcc1c0 100644
--- a/lib/js-yaml/index.js
+++ b/lib/js-yaml/index.js
@@ -1,15 +1,14 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.stringifyYaml = exports.parseYaml = void 0;
-// TODO: add a type for "types" https://github.com/DefinitelyTyped/DefinitelyTyped/blob/master/types/js-yaml/index.d.ts
-// eslint-disable-next-line @typescript-eslint/ban-ts-comment
-// @ts-ignore
-const js_yaml_1 = require("js-yaml");
-const DEFAULT_SCHEMA_WITHOUT_TIMESTAMP = js_yaml_1.JSON_SCHEMA.extend({
-    implicit: [js_yaml_1.types.merge],
-    explicit: [js_yaml_1.types.binary, js_yaml_1.types.omap, js_yaml_1.types.pairs, js_yaml_1.types.set],
-});
-const parseYaml = (str, opts) => (0, js_yaml_1.load)(str, { schema: DEFAULT_SCHEMA_WITHOUT_TIMESTAMP, ...opts });
-exports.parseYaml = parseYaml;
-const stringifyYaml = (obj, opts) => (0, js_yaml_1.dump)(obj, opts);
-exports.stringifyYaml = stringifyYaml;
+import { CORE_SCHEMA, mergeTag, binaryTag, omapTag, pairsTag, setTag, loadAll, dump, YAMLException, } from 'js-yaml';
+const DEFAULT_SCHEMA_WITHOUT_TIMESTAMP = CORE_SCHEMA.withTags(mergeTag, binaryTag, omapTag, pairsTag, setTag);
+export const parseYaml = (str, opts) => {
+    const documents = loadAll(str, { schema: DEFAULT_SCHEMA_WITHOUT_TIMESTAMP, ...opts });
+    if (documents.length === 0) {
+        return str.trim() === '' ? undefined : null;
+    }
+    if (documents.length > 1) {
+        throw new YAMLException('expected a single document in the stream, but found more');
+    }
+    return documents[0];
+};
+export const stringifyYaml = (obj, opts) => dump(obj, opts);
+//# sourceMappingURL=index.js.map
\ No newline at end of file
diff --git a/lib/js-yaml/index.js.map b/lib/js-yaml/index.js.map
new file mode 100644
index 0000000000000000000000000000000000000000..f265fdd4484b0544ddccaa713711f8f85991eb66
--- /dev/null
+++ b/lib/js-yaml/index.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/js-yaml/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,QAAQ,EACR,SAAS,EACT,OAAO,EACP,QAAQ,EACR,MAAM,EACN,OAAO,EACP,IAAI,EACJ,aAAa,GAGd,MAAM,SAAS,CAAC;AAEjB,MAAM,gCAAgC,GAAG,WAAW,CAAC,QAAQ,CAC3D,QAAQ,EACR,SAAS,EACT,OAAO,EACP,QAAQ,EACR,MAAM,CACP,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,IAAkB,EAAW,EAAE;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACtF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CAAC,0DAA0D,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAQ,EAAE,IAAkB,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC"}
\ No newline at end of file
diff --git a/package.json b/package.json
index b723b127ea4333c84b83ca92202b242daa09ef7a..5910bdab54d0cb8bb15523d00053071bf2383eb6 100644
--- a/package.json
+++ b/package.json
@@ -40,7 +40,7 @@
     "colorette": "1.4.0",
     "https-proxy-agent": "7.0.6",
     "js-levenshtein": "1.1.6",
-    "js-yaml": "4.2.0",
+    "js-yaml": "5.2.1",
     "minimatch": "5.1.9",
     "pluralize": "8.0.0",
     "yaml-ast-parser": "0.0.43"

File: openapi-typescript@7.13.0.patch

diff --git a/package.json b/package.json
index 4893afdec25f506f62d44f64fe0861c411cb7fae..3b98ab71d0a873afc2021ee213d876be44837f4d 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "typescript": "^5.x"
   },
   "dependencies": {
-    "@redocly/openapi-core": "^1.34.6",
+    "@redocly/openapi-core": "1.34.17",
     "ansi-colors": "^4.1.3",
     "change-case": "^5.4.4",
     "parse-json": "^8.3.0",
@@ -54,7 +54,6 @@
   },
   "devDependencies": {
     "@types/degit": "2.8.6",
-    "@types/js-yaml": "4.0.9",
     "degit": "2.8.4",
     "execa": "^9.6.1",
     "strip-ansi": "7.1.2",

3. Run pnpm install again just to be sure.

I hope it works for you as well. :)

EDIT: There was 2 rules in this file no-invalid-media-type-examples.test.ts (in @redocly-cli) , the first and one more.