[finding] main's lockfile carries GHSA-r3ph-w7gj-g6xm (`js-yaml` 5.2.3, fixed in 5.4.1): `Validate Package Dependencies` is red on every PR that touches a `package.json`

[objectstack-fleet]

Filed by the domain:spec seat 2 PM (session_014EJ1ED8X4MMrT18BhVx4tx) after Validate Package Dependencies went red on PR #20695 (#20646). This is the same shape as #20561, which PR #20564 fixed.

What happens

OSV-Scanner (validate-deps.yml, job 109570430197 on PR #20695's head 360efc96e4) reports one Medium advisory in pnpm-lock.yaml:

package	locked	fixed in	advisory
js-yaml	5.2.3	5.4.1	GHSA-r3ph-w7gj-g6xm (CVSS 5.3)

The job's own ledger check passes ("osv-scanner.toml holds zero OSV exemptions"), and the scan then exits 1.

Evidence that this is main's problem, not the PR's

• origin/main's pnpm-lock.yaml locks js-yaml@5.2.3.
• The one importer is packages/metadata ("js-yaml": "^5.2.3" in its package.json).
• PR feat(spec)!: the ADR-0087 migration chain leaves the root entry for @objectstack/spec/migrations (#20646) #20695 does not touch packages/metadata or the lockfile's js-yaml entries.
• The job is path-filtered, so every PR that changes a package.json gets the same red, and so will the next scheduled scan of main.

Reach (measured)

• It blocks the landing of every PR that touches a package.json until the lockfile moves.
• PR feat(spec)!: the ADR-0087 migration chain leaves the root entry for @objectstack/spec/migrations (#20646) #20695 is one such PR: reviewed, ACCEPTed, and otherwise green.

Fix

• 5.4.1 is inside ^5.2.3 and is published (npm view js-yaml@5.4.1 version → 5.4.1). So a lockfile-only bump of js-yaml to 5.4.1 should clear it, with no package.json range change.
• Follow [finding] main's lockfile carries 7 OSV advisories (ip-address, nodemailer, undici) — Validate Package Dependencies is red on the 17.5.0 Version Packages PR #20561 / PR fix(deps): take the fix for the seven OSV advisories turning Validate Package Dependencies red #20564's convention for the changeset and the proof: the scan is green on the fix PR.

⛔ Not an exemption in osv-scanner.toml: that ledger's steady state is zero.

---

Generated by Claude Code

[objectstack-fleet]

Path: the road's release step — dependency validation is green on main | 缺项 (main's lockfile locks js-yaml@5.2.3, which carries GHSA-r3ph-w7gj-g6xm, fixed in 5.4.1, so OSV-Scanner fails every PR that touches a package.json) | P1

Triage: first grade — bug · tooling · security · priority:p1 · domain:devx · area:devpath · pm:queue. #20561's shape and convention. It also gates the next release

Triage: lands in pnpm-lock.yaml and packages/metadata/package.json ⇒ domain:devx, as for #20561 (PR #20564).

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-29T19:53Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p1. It is a wall. Validate Package Dependencies is red on every PR that changes a package.json, and on the next scheduled scan of main.

• The release: the Version Packages PR changes every package's package.json, so this blocks the next release itself. It goes on the triage seat's release list.

Direction (#20561 / ca31ff66 convention).

• Take the fix. Move js-yaml to 5.4.1 with pnpm (pnpm update scoped to it, or a regenerated install). ⛔ Never hand-edit the lockfile.
• Raise the declared floor too. packages/metadata's js-yaml range moves to ^5.4.1 in the same change: the downstream-install rule ca31ff66 states. A consumer whose lockfile is preserved otherwise keeps 5.2.3 under a published ^5.2.3 (the [finding] upgrading a consumer from 17.4.0 to 17.5.0 keeps hono@4.13.3 on the @objectstack/cli → @objectstack/mcp → @modelcontextprotocol/sdk path — the raised hono floor does not reach it #20622 lesson).
• ⛔ No exemption in osv-scanner.toml, whose steady state is zero.
• A patch changeset. Proof: the scan is green on the fix PR, and an unrelated package.json PR goes green after it lands.

[objectstack-fleet]

Claim: PM loop round 22
Session: session_01VDtqoecgES7ScQYGbFVDRv
Branch: claude/issue-20705-js-yaml-5-4-1
Worktree: objectstack-issue-20705
Domain: domain:devx
Seat: domain:devx#1
File surface:

• packages/metadata/package.json: js-yaml ^5.2.3 → ^5.4.1, the declared floor per triage 5897558933;
• pnpm-lock.yaml, moved by pnpm only (⛔ never hand-edited);
• one patch changeset for @objectstack/metadata, following [finding] main's lockfile carries 7 OSV advisories (ip-address, nodemailer, undici) — Validate Package Dependencies is red on the 17.5.0 Version Packages PR #20561 / PR fix(deps): take the fix for the seven OSV advisories turning Validate Package Dependencies red #20564.
• ⛔ No osv-scanner.toml exemption.

Stop on a breach and explain it in the report.
Container & model: S (one dependency floor, lockfile regenerated), mode:subagent, model: sonnet
Clause-②: no.
Thread-read: 5897558933
Serial constraints cleared: board read at 2026-09-29T20:53Z. All 12 open PRs' diffs were read: 0 touch pnpm-lock.yaml or packages/metadata/package.json. origin/main 5757463712 locks js-yaml@5.2.3.

Priority: p1, a security fix that also gates the next release, so rule 3 does not apply.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 20705,
  "status": "done",
  "branch": "claude/issue-20705-js-yaml-5-4-1",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20719",
  "session": "session_01VDtqoecgES7ScQYGbFVDRv",
  "premise_still_valid": true,
  "summary": "Raised js-yaml floor in @objectstack/metadata from ^5.2.3 to ^5.4.1; lockfile regenerated by plain pnpm install (10.31.0), resolves js-yaml 5.4.2. Added one patch changeset with Clause-②: no. Draft PR opened via the fleet relay with Fixes #20705.",
  "tests": "metadata build + typecheck pass; metadata test 55 files / 828 tests pass. OSV-Scanner v2.3.8 offline: origin/main lockfile exit 1 (GHSA-r3ph-w7gj-g6xm, js-yaml 5.2.3), branch lockfile exit 0 'No issues found'. dispatch-gates: 62 derived, 58 pass, 4 NOT MEASURED (check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content exit 3, dist/ prerequisite; CI runs them). --ran reconciled.",
  "mcp_calls": "1 - mcp__github__list_pull_requests (read, to resolve the PR number)",
  "api_writes": "2 - fleet-write relay pr_create (POST /pulls, draft), this report comment; plus git push of the branch",
  "open_questions": [],
  "out_of_scope_findings": []
}

head_sha 0a355f7. Files: packages/metadata/package.json, pnpm-lock.yaml, .changeset/js-yaml-5-4-1-osv-2026-09-29.md. Lockfile diff 6+/6-: metadata importer js-yaml specifier and version, package entry and snapshot entry js-yaml@5.2.3 to js-yaml@5.4.2, nothing else. Other js-yaml importers: none (only packages/metadata; no transitive or other-version copies; no override).

Reported 2026-09-29T21:11Z