Security Vulnerability in peer dependancy "yaml" need to update to yaml 2.8.3
Author: AbhaysinghBhosaleCreated Aug 17, 2026Updated Aug 17, 2026
This library 'patch-package' is using yaml in its peer dependancies which is having security vulnerability and version of peer dependancy should be upgraded.
"yaml" vulnerability Affected versions of this package are vulnerable to Uncontrolled Recursion in the compose/resolve phase due to using recursive function calls without a depth bound. An attacker can cause the application to throw a RangeError and potentially terminate the Node.js process by supplying a deeply nested YAML payload that exhausts the call stack.
Solution
Upgrade yaml to version 2.8.3 or higher.
Source: ds300/patch-package