From 13ef54805c5fba8867a65b43f5bd4a2f6e06bb1e Mon Sep 17 00:00:00 2001
From: Koen De Groote <kdg.dev@gmail.com>
Date: Sun, 20 Sep 2026 21:14:57 +0200
Subject: [PATCH] Update js-yaml to 5.4.2 to fix CVE
 https://nvd.nist.gov/vuln/detail/cve-2026-84375

Correct code comment.
---
 lib/grunt/file.js | 10 +++-------
 package.json      |  2 +-
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/lib/grunt/file.js b/lib/grunt/file.js
index 9619e808..cfda6258 100644
--- a/lib/grunt/file.js
+++ b/lib/grunt/file.js
@@ -247,13 +247,9 @@ file.readYAML = function(filepath, options, yamlOptions) {
   var result;
   grunt.verbose.write('Parsing ' + filepath + '...');
   try {
-    // use the recommended way of reading YAML files
-    // https://github.com/nodeca/js-yaml#safeload-string---options-
-    if (yamlOptions.unsafeLoad) {
-      result = YAML.load(src);
-    } else {
-      result = YAML.safeLoad(src);
-    }
+    // Since js-yaml 4, `safeLoad()` was removed and `load()` became the standard safe loader.
+    result = YAML.load(src);
+
     grunt.verbose.ok();
     return result;
   } catch (e) {
diff --git a/package.json b/package.json
index 918ffc54..823d1d6b 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
     "grunt-legacy-log": "~3.0.0",
     "grunt-legacy-util": "~2.0.1",
     "iconv-lite": "~0.6.3",
-    "js-yaml": "^3.15.0",
+    "js-yaml": "5.4.2",
     "minimatch": "^3.1.5",
     "nopt": "^5.0.0"
   },