Description

@nx/js pulls in yaml@1.10.2 as a transitive dependency through the chain:

@nx/js → babel-plugin-macros@3.1.0 → cosmiconfig@7.1.0 → yaml@1.10.2

yaml@1.10.2 has a known vulnerability (see GHSA-48c2-rrv3-qjmp — stack overflow via deeply nested YAML collections). The fix is available in yaml@1.10.3.

Steps to Reproduce

1. Create a project using @nx/js@22.6.1
2. Run npm audit
3. Observe yaml@1.10.2 flagged as vulnerable via the babel-plugin-macros → cosmiconfig chain

Expected Behavior

@nx/js should depend on (or pin) versions of transitive dependencies that do not have known vulnerabilities. Updating cosmiconfig or adding an override for yaml >=1.10.3 in @nx/js would resolve this.

Current Workaround

Consumers can override the resolution in their own package-lock.json to force yaml@1.10.3.

Environment

• Nx version: 22.6.1
• Node version: v22
• Package manager: npm