fix: drop obsolete resolutions whose blockers shipped (#24673)
## Summary Housekeeping on the `resolutions` block: audits every entry against the current tree and **removes the three whose blocker has shipped**. No version forced anywhere new - this PR only stops forcing things that no longer need it. | Removed | Why it existed | Why it can go | |---|---|---| | `sockjs/uuid` | sockjs pinned uuid <11 with no fixed release | **sockjs left the dependency tree entirely** - dead entry | | `body-parser/qs` | express 4.x bundled body-parser 1.20.4 pinning `qs ~6.14.0` (below the 6.15.2 fix) | body-parser now resolves 1.20.6 / 2.3.0, whose `qs ~6.15.1` / `^6.15.2` reach the fix in range (copy lands on 6.15.3) | | `@istanbuljs/load-nyc-config/js-yaml` | js-yaml 3.x had **no patched release**, so this ^3.13.1 consumer was forced onto 4.x | the 3.x line shipped backports (**3.15.0** fixes GHSA-h67p-54hq-rp68 + GHSA-52cp-r559-cp3m, **3.15.1** fixes GHSA-5p4m-2wfm-xmqj) - it resolves a clean 3.15.1 naturally, and as build-only coverage tooling that is enough | ## Deliberately kept: `front-matter/js-yaml` + the safeLoad patch front-matter (via mintlify, parses docs content) had the same 3.x-backport escape available, but **stays forced onto js-yaml 4.3.1**: 4.x is the maintained line, while the 3.x fixes were backports to a legacy major that future advisories may not get. The companion patch (`loader = parser.load`) exists because 4.x removed the `safeLoad` API front-matter's default path calls; pin and patch are a **matched pair** - the patch without the pin would select 3.x's *unsafe* full-schema `load` - so they only ever move together. `//resolutions` records the split decision (unpin the build-only tool onto the backported line, keep the docs-content parser on the maintained line). ## Verification - `yarn.lock`: front-matter resolves the patch locator with js-yaml forced to **4.3.1**; the `^3.13.1` entry (now load-nyc-config only) resolves **3.15.1**; qs resolves 6.15.2 / 6.15.3 only; uuid unchanged (11.1.1 + intentional 13.x). - `mintlify validate` passes; front-matter parses docs front-matter at runtime. - `yarn install --immutable` passes.
A
Abdullah. committed
a01baa356e7c7af57e04ba999dc9e6e326017dcb
Parent: e654e02
Committed by GitHub <noreply@github.com>
on 8/24/2026, 7:04:39 AM