From 8e0b69b8eb00001a998a53bb79d37c4e834597c5 Mon Sep 17 00:00:00 2001
From: snyk-bot <snyk-bot@snyk.io>
Date: Tue, 20 Jan 2026 11:29:29 +0000
Subject: [PATCH] fix: package.json & package-lock.json to reduce
 vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-JSYAML-13961110
---
 package-lock.json | 69 +++++++++++++++++++++++++++++++++++------------
 package.json      |  2 +-
 2 files changed, 53 insertions(+), 18 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index fef2be20353..b929190534a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,7 +11,7 @@
       "dependencies": {
         "adm-zip": "0.4.7",
         "body-parser": "1.9.0",
-        "cfenv": "^1.0.4",
+        "cfenv": "^1.2.5",
         "consolidate": "0.14.5",
         "dustjs-helpers": "1.5.0",
         "dustjs-linkedin": "2.5.0",
@@ -1091,13 +1091,32 @@
       "integrity": "sha1-G2gcIf+EAzyCZUMJBolCDRhxUdw="
     },
     "node_modules/cfenv": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/cfenv/-/cfenv-1.2.2.tgz",
-      "integrity": "sha512-fl8xrG9ezqfO7L664lL+/vkqXun0D/xS/0IJ9++IMHLR6SI0If56C/KIHy9oIGb8jq9swHZFdct1MfN/80yYUw==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/cfenv/-/cfenv-1.2.5.tgz",
+      "integrity": "sha512-XvmFP1h3XVqdXQbDpFgkQOWb1XUBG6Gu052JVuyLbJToScDiX7InAZm2z8cER8CsT9ZN0IZivjps+rf7UidNGg==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "js-yaml": "3.13.x",
+        "js-yaml": "4.1.x",
         "ports": "1.1.x",
-        "underscore": "1.9.x"
+        "underscore": "1.12.x"
+      }
+    },
+    "node_modules/cfenv/node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "license": "Python-2.0"
+    },
+    "node_modules/cfenv/node_modules/js-yaml": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
       }
     },
     "node_modules/chalk": {
@@ -12088,9 +12107,10 @@
       "dev": true
     },
     "node_modules/underscore": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.9.1.tgz",
-      "integrity": "sha512-5/4etnCkd9c8gwgowi5/om/mYO5ajCaOgdzj/oW+0eQV9WxKBDZw5+ycmKmeaTXjInS/W0BzpGLo2xR2aBwZdg=="
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.12.1.tgz",
+      "integrity": "sha512-hEQt0+ZLDVUMhebKxL4x1BTtDY7bavVofhZ9KZ4aI26X9SRaE+Y3m83XUL1UP2jn8ynjndwCCpEHdUG+9pP1Tw==",
+      "license": "MIT"
     },
     "node_modules/unicode-length": {
       "version": "1.0.3",
@@ -13518,13 +13538,28 @@
       "integrity": "sha1-G2gcIf+EAzyCZUMJBolCDRhxUdw="
     },
     "cfenv": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/cfenv/-/cfenv-1.2.2.tgz",
-      "integrity": "sha512-fl8xrG9ezqfO7L664lL+/vkqXun0D/xS/0IJ9++IMHLR6SI0If56C/KIHy9oIGb8jq9swHZFdct1MfN/80yYUw==",
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/cfenv/-/cfenv-1.2.5.tgz",
+      "integrity": "sha512-XvmFP1h3XVqdXQbDpFgkQOWb1XUBG6Gu052JVuyLbJToScDiX7InAZm2z8cER8CsT9ZN0IZivjps+rf7UidNGg==",
       "requires": {
-        "js-yaml": "3.13.x",
+        "js-yaml": "4.1.x",
         "ports": "1.1.x",
-        "underscore": "1.9.x"
+        "underscore": "1.12.x"
+      },
+      "dependencies": {
+        "argparse": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+          "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="
+        },
+        "js-yaml": {
+          "version": "4.1.1",
+          "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+          "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+          "requires": {
+            "argparse": "^2.0.1"
+          }
+        }
       }
     },
     "chalk": {
@@ -22324,9 +22359,9 @@
       }
     },
     "underscore": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.9.1.tgz",
-      "integrity": "sha512-5/4etnCkd9c8gwgowi5/om/mYO5ajCaOgdzj/oW+0eQV9WxKBDZw5+ycmKmeaTXjInS/W0BzpGLo2xR2aBwZdg=="
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.12.1.tgz",
+      "integrity": "sha512-hEQt0+ZLDVUMhebKxL4x1BTtDY7bavVofhZ9KZ4aI26X9SRaE+Y3m83XUL1UP2jn8ynjndwCCpEHdUG+9pP1Tw=="
     },
     "unicode-length": {
       "version": "1.0.3",
diff --git a/package.json b/package.json
index d5f9362a36d..f7558ba63bb 100644
--- a/package.json
+++ b/package.json
@@ -17,7 +17,7 @@
   "dependencies": {
     "adm-zip": "0.4.7",
     "body-parser": "1.9.0",
-    "cfenv": "^1.0.4",
+    "cfenv": "^1.2.5",
     "consolidate": "0.14.5",
     "dustjs-helpers": "1.5.0",
     "dustjs-linkedin": "2.5.0",
