From 8274fc648165c341831d7d8f1cbe8a760ca5555c Mon Sep 17 00:00:00 2001 From: Kamalpreet Kaur Date: Tue, 29 Sep 2026 20:10:28 +0530 Subject: [PATCH 1/2] fix(deps): raise chalk floor to ^5.6.2 to exclude malicious 5.6.1 chalk@5.6.1 was published by a hijacked maintainer account (GHSA-2v46-p5h4-248w / MAL-2025-46969). chalk is an external runtime dependency of the service, so consumers resolve it against our declared range; ^5.3.0 still admits 5.6.1 from any mirror or cache that retained it. The lockfile already resolves 5.6.2, so the installed tree is unchanged. Co-Authored-By: Claude Opus 5.5 (1M context) --- package-lock.json | 2 +- packages/browserstack-service/package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package-lock.json b/package-lock.json index 6c7bc72..f9f67c7 100644 --- a/package-lock.json +++ b/package-lock.json @@ -12919,7 +12919,7 @@ "@wdio/reporter": "^9.0.0", "@wdio/types": "^9.0.0", "browserstack-local": "^1.5.1", - "chalk": "^5.3.0", + "chalk": "^5.6.2", "csv-writer": "^1.6.0", "git-repo-info": "^2.1.1", "gitconfiglocal": "^2.1.0", diff --git a/packages/browserstack-service/package.json b/packages/browserstack-service/package.json index 2ea9eae..45455b1 100644 --- a/packages/browserstack-service/package.json +++ b/packages/browserstack-service/package.json @@ -64,7 +64,7 @@ "@wdio/reporter": "^9.0.0", "@wdio/types": "^9.0.0", "browserstack-local": "^1.5.1", - "chalk": "^5.3.0", + "chalk": "^5.6.2", "csv-writer": "^1.6.0", "git-repo-info": "^2.1.1", "gitconfiglocal": "^2.1.0", From 706da2a6ca7eb71b3f0393cf8a9f3bdb750c3df8 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 29 Sep 2026 14:42:03 +0000 Subject: [PATCH 2/2] chore(changeset): auto-generate from PR template (patch) --- .changeset/pr-255.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/pr-255.md diff --git a/.changeset/pr-255.md b/.changeset/pr-255.md new file mode 100644 index 0000000..99fbf74 --- /dev/null +++ b/.changeset/pr-255.md @@ -0,0 +1,5 @@ +--- +"@wdio/browserstack-service": patch +--- + +- Raised the minimum `chalk` version to 5.6.2 so installs can never resolve the compromised `chalk@5.6.1` (GHSA-2v46-p5h4-248w).