Latest openapi-typescript pulls vulnerable js-yaml via archived @redocly/openapi-core 1.x

openapi-typescript version

7.13.0

Node.js version

v24.11.1

OS + version

macOS 15.6

Description

Summary

pnpm audit --audit-level=high fails when using the latest openapi-typescript.

The latest version (7.13.0) depends on:

openapi-typescript
└── @redocly/openapi-core ^1.34.6
    └── js-yaml 4.2.0

js-yaml 4.2.0 is now reported as vulnerable (GHSA-52cp-r559-cp3m), causing CI to fail even though all direct dependencies are up to date.

Steps to reproduce

Install the latest version:

pnpm add -D openapi-typescript@latest

Run:

pnpm audit --audit-level=high

Actual result

Audit reports:

High severity vulnerability

Package: js-yaml
Affected versions: >=4.0.0 <4.3.0
Patched version: >=4.3.0

Dependency path:

openapi-typescript
→ @redocly/openapi-core
→ js-yaml

Expected result

The latest openapi-typescript should not pull a dependency with a known high-severity vulnerability.

Additional information

Current versions:

openapi-typescript 7.13.0
@redocly/openapi-core 1.34.17

It looks like openapi-typescript still depends on the archived @redocly/openapi-core 1.x branch, while the actively maintained branch is now 2.x.

Is there a planned update, or is using pnpm.overrides currently the recommended workaround?

Reproduction

1. Install the latest version of openapi-typescript.

pnpm add -D openapi-typescript@latest

1. Run:

pnpm audit --audit-level=high

1. Audit reports a high severity vulnerability coming from the dependency chain:

openapi-typescript
→ @redocly/openapi-core
→ js-yaml

Current resolved versions:

openapi-typescript 7.13.0
@redocly/openapi-core 1.34.17
js-yaml 4.2.0

js-yaml 4.2.0 is reported as vulnerable (GHSA-52cp-r559-cp3m).

The issue reproduces on a clean install and is independent of the project itself.

Expected result

The latest openapi-typescript should not resolve to a dependency tree containing a known high-severity vulnerability.

Ideally the package should either:

• update to a maintained version of @redocly/openapi-core, or
• otherwise avoid pulling js-yaml <4.3.0.

At the moment the only apparent workaround is using pnpm.overrides, which ideally should not be necessary when using the latest released version.

Required

• My OpenAPI schema is valid and passes the Redocly validator (npx @redocly/cli@latest lint)

Extra

• I’m willing to open a PR (see CONTRIBUTING.md)