From ab7ef60d07f6f8fba527416c03a03d37f84edade Mon Sep 17 00:00:00 2001 From: "Eli Kent [SSW]" <69125238+kulesy@users.noreply.github.com> Date: Wed, 19 Aug 2026 11:59:25 +1000 Subject: [PATCH 1/4] fix(deps): move @tinacms/cli off the vulnerable js-yaml 4.1.1 (#7447) Closes #7446 **TL;DR** `@tinacms/cli` currently ships a vulnerable js-yaml. One specifier change moves it to the patch on its own major line. **Pain:** GHSA-5p4m-2wfm-xmqj (high) covers both major lines, `>= 3.0.0 < 3.15.1` patched by 3.15.1 and `>= 4.0.0 < 4.3.1` patched by 4.3.1. #7425 closed the 3.x side by moving `@tinacms/graphql` to 3.15.1, which makes the repo look addressed, but `@tinacms/cli` was left on 4.1.1, inside the vulnerable 4.x range. js-yaml is a runtime `dependencies` entry there and the package is published, so `npm install @tinacms/cli` pulls a vulnerable copy today. Neither CI nor `dependency-review` flagged it, since the 4.x version was already present on `main` rather than introduced by a diff. **Solution:** Sets the specifier to `^4.3.1`, resolving 4.3.1. Afterwards no workspace package sits on a vulnerable js-yaml. A transitive 4.1.1 remains via `astro`, `cosmiconfig` and `eslint`, which is upstream of this repo and out of scope here. Co-authored-by: Claude Opus 5 --- packages/@tinacms/cli/package.json | 2 +- pnpm-lock.yaml | 12 ++++++++++-- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/packages/@tinacms/cli/package.json b/packages/@tinacms/cli/package.json index a01eec4b63..ae3fddaa9a 100644 --- a/packages/@tinacms/cli/package.json +++ b/packages/@tinacms/cli/package.json @@ -91,7 +91,7 @@ "esbuild": "catalog:", "fs-extra": "catalog:", "graphql": "15.8.0", - "js-yaml": "^4.1.0", + "js-yaml": "^4.3.1", "many-level": "catalog:", "memory-level": "catalog:", "minimatch": "catalog:", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 81dec9e2ca..13b5d6d694 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1438,8 +1438,8 @@ importers: specifier: 15.8.0 version: 15.8.0 js-yaml: - specifier: ^4.1.0 - version: 4.1.1 + specifier: ^4.3.1 + version: 4.3.1 many-level: specifier: 'catalog:' version: 2.0.0 @@ -12174,6 +12174,10 @@ packages: resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==} hasBin: true + js-yaml@4.3.1: + resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} + hasBin: true + jsbn@0.1.1: resolution: {integrity: sha512-UVU9dibq2JcFWxQPA6KCqj5O42VOmAY3zQUfEKxU0KpTGXwNoCjkX1e13eHNvw/xPynt6pU0rZ1htjWTNTSXsg==} @@ -29396,6 +29400,10 @@ snapshots: dependencies: argparse: 2.0.1 + js-yaml@4.3.1: + dependencies: + argparse: 2.0.1 + jsbn@0.1.1: optional: true From 41263f503e4c02f3b9272aa5dca6fc2c572a60eb Mon Sep 17 00:00:00 2001 From: "Eli Kent [SSW]" <69125238+kulesy@users.noreply.github.com> Date: Wed, 19 Aug 2026 12:12:35 +1000 Subject: [PATCH 2/4] chore: add missing changeset for the js-yaml 4.3.1 bump (#7454) Closes #7453 **TL;DR** #7447 fixed the vulnerable js-yaml but merged without a changeset, so the fix is sitting on `main` unreleased. This adds one. **Pain:** `@tinacms/cli` is published and not in the changesets `ignore` list, so a dependency change there needs a changeset to produce a version bump and a release. #7447 moved it from the vulnerable js-yaml 4.1.1 to 4.3.1, closing GHSA-5p4m-2wfm-xmqj on `main`, but with no changeset there is no release. The published package keeps resolving 4.1.1, so `npm install @tinacms/cli` still pulls the vulnerable copy and the advisory stays open for users. **Solution:** Adds a changeset marking `@tinacms/cli` `patch` and naming the js-yaml bump with its advisory. Version Packages #7443 is still open, so this is picked up in the current release rather than the one after. Co-authored-by: Claude Opus 5 --- .changeset/bump-js-yaml-cli-4-3-1.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/bump-js-yaml-cli-4-3-1.md diff --git a/.changeset/bump-js-yaml-cli-4-3-1.md b/.changeset/bump-js-yaml-cli-4-3-1.md new file mode 100644 index 0000000000..1d2a875040 --- /dev/null +++ b/.changeset/bump-js-yaml-cli-4-3-1.md @@ -0,0 +1,5 @@ +--- +'@tinacms/cli': patch +--- + +Bump `js-yaml` to 4.3.1, picking up an upstream security fix (GHSA-5p4m-2wfm-xmqj) From 195087de7e617d9d91b06709db869787ac0c800f Mon Sep 17 00:00:00 2001 From: "Eli Kent [SSW]" <69125238+kulesy@users.noreply.github.com> Date: Wed, 19 Aug 2026 12:34:57 +1000 Subject: [PATCH 3/4] chore: add missing changesets for two merged dependency fixes (#7456) Closes #7455 **TL;DR** #7425 and #7321 merged without changesets, so both fixes are stranded on `main`. This adds them. **Pain:** `@tinacms/graphql` and `tinacms-authjs` are both published and neither is in the changesets `ignore` list, so a dependency change in either needs a changeset to produce a version bump and a release. #7425 moved `@tinacms/graphql` to js-yaml 3.15.1 and #7321 moved `tinacms-authjs` to next-auth 4.24.15, both without one. The js-yaml case matters most: it closed GHSA-5p4m-2wfm-xmqj on the 3.x line, and `@tinacms/graphql` is the package that parses content YAML, so the published package still resolves the vulnerable 3.14.2 until a release ships. **Solution:** Adds a changeset for each, both `patch`, naming the bump and its advisory where there is one. Version Packages #7443 is still open, so these are picked up in the current release rather than the one after. Co-authored-by: Claude Opus 5 --- .changeset/bump-js-yaml-graphql-3-15-1.md | 5 +++++ .changeset/bump-next-auth-4-24-15.md | 5 +++++ 2 files changed, 10 insertions(+) create mode 100644 .changeset/bump-js-yaml-graphql-3-15-1.md create mode 100644 .changeset/bump-next-auth-4-24-15.md diff --git a/.changeset/bump-js-yaml-graphql-3-15-1.md b/.changeset/bump-js-yaml-graphql-3-15-1.md new file mode 100644 index 0000000000..c83d51bf02 --- /dev/null +++ b/.changeset/bump-js-yaml-graphql-3-15-1.md @@ -0,0 +1,5 @@ +--- +'@tinacms/graphql': patch +--- + +Bump `js-yaml` to 3.15.1, picking up an upstream security fix (GHSA-5p4m-2wfm-xmqj) diff --git a/.changeset/bump-next-auth-4-24-15.md b/.changeset/bump-next-auth-4-24-15.md new file mode 100644 index 0000000000..f50a9cb621 --- /dev/null +++ b/.changeset/bump-next-auth-4-24-15.md @@ -0,0 +1,5 @@ +--- +'tinacms-authjs': patch +--- + +Bump `next-auth` to 4.24.15 From fc8ddd4e90558408fc649f0dd3ddbcdbdb7ed028 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 14:13:35 +1000 Subject: [PATCH 4/4] chore(deps): bump tar from 7.5.21 to 7.5.22 (#7438) Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.21 to 7.5.22.
Commits

--------- Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: kulesy Co-authored-by: Claude Opus 5 Co-authored-by: Eli Kent [SSW] <69125238+kulesy@users.noreply.github.com> --- .changeset/bump-tar-7-5-22.md | 5 +++++ pnpm-lock.yaml | 12 ++++++------ pnpm-workspace.yaml | 2 +- 3 files changed, 12 insertions(+), 7 deletions(-) create mode 100644 .changeset/bump-tar-7-5-22.md diff --git a/.changeset/bump-tar-7-5-22.md b/.changeset/bump-tar-7-5-22.md new file mode 100644 index 0000000000..79172f3ee4 --- /dev/null +++ b/.changeset/bump-tar-7-5-22.md @@ -0,0 +1,5 @@ +--- +'create-tina-app': patch +--- + +Bump `tar` to 7.5.22 diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 13b5d6d694..da5327b194 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -601,8 +601,8 @@ catalogs: specifier: 4.0.3 version: 4.0.3 tar: - specifier: 7.5.21 - version: 7.5.21 + specifier: 7.5.22 + version: 7.5.22 ts-jest: specifier: ^29.2.5 version: 29.4.6 @@ -2069,7 +2069,7 @@ importers: version: 5.27.14 tar: specifier: 'catalog:' - version: 7.5.21 + version: 7.5.22 devDependencies: '@tinacms/scripts': specifier: workspace:* @@ -15151,8 +15151,8 @@ packages: resolution: {integrity: sha512-tOG/7GyXpFevhXVh8jOPJrmtRpOTsYqUIkVdVooZYJS/z8WhfQUX8RJILmeuJNinGAMSu1veBr4asSHFt5/hng==} engines: {node: '>=18'} - tar@7.5.21: - resolution: {integrity: sha512-XdhtCvlMywwxpCW8YEq3lOXBJpUPTR2OHHcwLPO3HwsJqOHa2Ok/oJ7ruGzp+JrKoRPVCzJwAdEjqLW/vNRPHA==} + tar@7.5.22: + resolution: {integrity: sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==} engines: {node: '>=18'} term-size@2.2.1: @@ -33543,7 +33543,7 @@ snapshots: minizlib: 3.1.0 yallist: 5.0.0 - tar@7.5.21: + tar@7.5.22: dependencies: '@isaacs/fs-minipass': 4.0.1 chownr: 3.0.0 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 538e735876..1dd8830667 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -246,7 +246,7 @@ catalog: stopword: ^3.1.4 stringify-entities: 4.0.3 tailwindcss-animate: ^1.0.7 - tar: 7.5.21 + tar: 7.5.22 ts-jest: ^29.2.5 ts-node: ^10.9.2 tsc-alias: ^1.8.10