pm2@7.0.2

Author: Unitech

CHANGELOG.md

@@ -16,8 +16,15 @@
 
 ### Core Refactor
 
+- Drop old vizion module, refactor to support only git and drop 3 submodules
 - Replace the bundled `pm2-sysmonit` module and `systeminformation` with `lib/tools/SysMetrics.js` (Linux/macOS); `pm2 slist`/`getSystemData` and the Docker metrics path now read this collector. Covered by `test/programmatic/sysmetrics.mocha.js`
 
+### Security
+
+- Bump `js-yaml` 4.1.1 → 4.3.0 — fixes quadratic-complexity DoS in merge-key handling (GHSA-h67p-54hq-rp68) #6122
+- Bump `ws` 8.20.0 → 8.21.0 — fixes uninitialized-memory disclosure and tiny-fragment DoS (GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p) #6116
+- Bump `@pm2/js-api` 0.8.0 → 0.8.1, pulling in patched `ws@8.21.0` (its transitive `ws` was pinned to the vulnerable 7.x). Production deps are now advisory-free (`npm audit --omit=dev` clean)
+
 ## 7.0.1
 
 ### Bug Fixes

package.json

@@ -123,7 +123,7 @@
   },
   "dependencies": {
     "@pm2/blessed": "0.1.81",
-    "@pm2/js-api": "0.8.0",
+    "@pm2/js-api": "0.8.1",
     "@pm2/pm2-version-check": "1.0.4",
     "amp": "0.3.1",
     "amp-message": "0.1.2",
@@ -137,13 +137,13 @@
     "debug": "4.4.3",
     "eventemitter2": "6.4.9",
     "fast-json-patch": "3.1.1",
-    "js-yaml": "4.1.1",
+    "js-yaml": "4.3.0",
     "pidusage": "4.0.1",
     "pm2-deploy": "1.0.2",
     "proxy-agent": "6.5.0",
     "semver": "7.7.2",
     "tx2": "1.0.5",
-    "ws": "8.20.0"
+    "ws": "8.21.0"
   },
   "overrides": {
     "debug": "4.4.3"