Security vulnerability at js-yaml

[highfivedenis]

@commitlint/load uses a vulnerable version of cosmicconfig and tslint (which uses a vulnerable version of js-yml), see https://nodesecurity.io/advisories/788 for more details on the security issue.
js-yml 3.13.0 is patched, but cosmicconfig and tslint has yet to update its version.

yarn audit output:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Denial of Service                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ js-yaml                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ cosmiconfig                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ cosmiconfig > js-yaml                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/788                       │
└───────────────┴──────────────────────────────────────────────────────────────┘


┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Denial of Service                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ js-yaml                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ tslint                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ tslint > js-yaml                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/788                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

Expected Behavior

Use a patched version of cosmicconfig and tslint when it's available, see this cosmicconfig issue & pr and this tslint issue

Current Behavior

Uses a vulnerable version of cosmiconfig and tslint

[agrohs]

cosmiconfig seems to have upgraded to js-yml 3.13.0 in 5.2.0.

[ghost]

High	Code injection
Package	js-yaml
Dependency of	husky
Path	husky > cosmiconfig > js-yaml
More info	https://npmjs.com/advisories/813

[typicode]

Thanks for letting me know. All dependencies have been updated in v2.0.0, there shouldn't be warnings anymore 👍