Skip to content

chore(docs): bump js-yaml from 4.2.0 to 4.3.1 in /web-app - #983

Merged
pflynn-virtru merged 1 commit into
mainfrom
dependabot/npm_and_yarn/web-app/js-yaml-4.3.1
Aug 10, 2026
Merged

chore(docs): bump js-yaml from 4.2.0 to 4.3.1 in /web-app#983
pflynn-virtru merged 1 commit into
mainfrom
dependabot/npm_and_yarn/web-app/js-yaml-4.3.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps js-yaml from 4.2.0 to 4.3.1.

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.
Commits
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • 6842ef6 doc polish
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 10, 2026
@dependabot
dependabot Bot requested review from a team as code owners August 10, 2026 15:17
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 10, 2026
@github-actions

github-actions Bot commented Aug 10, 2026

Copy link
Copy Markdown

X-Test Results

✅ js@main-main
✅ js@pull-983-v0.9.0
✅ js@pull-983-main
✅ js@main-v0.9.0
✅ js@v0.4.0-main
✅ java@main-v0.9.0
✅ go@main-main
✅ js@v0.4.0-v0.9.0
✅ java@main-main
✅ go@main-v0.9.0
opentdf-ctl
opentdf-sdk-lib

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/web-app/js-yaml-4.3.1 branch from 85f94b8 to 03eb7c1 Compare August 10, 2026 15:39
@dependabot
chore(docs): bump js-yaml from 4.2.0 to 4.3.1 in /web-app
761dc97 
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.2.0 to 4.3.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/web-app/js-yaml-4.3.1 branch from 03eb7c1 to 761dc97 Compare August 10, 2026 15:42
@github-actions

github-actions Bot commented Aug 10, 2026

Copy link
Copy Markdown

X-Test Failure Report

opentdf-ctl
opentdf-sdk-lib

@github-actions

github-actions Bot commented Aug 10, 2026

Copy link
Copy Markdown

X-Test Results

✅ js@pull-983-main
✅ js@main-main
✅ js@pull-983-v0.9.0
✅ js@main-v0.9.0
✅ js@v0.4.0-main
✅ js@v0.4.0-v0.9.0
✅ java@main-main
✅ go@main-main
✅ java@main-v0.9.0
✅ go@main-v0.9.0
opentdf-ctl
opentdf-sdk-lib

pflynn-virtru
pflynn-virtru approved these changes Aug 10, 2026
View reviewed changes

@pflynn-virtru pflynn-virtru left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving: Dependabot security bump, required checks green.

@pflynn-virtru
pflynn-virtru merged commit fe60adf into main Aug 10, 2026
26 checks passed
@pflynn-virtru
pflynn-virtru deleted the dependabot/npm_and_yarn/web-app/js-yaml-4.3.1 branch August 10, 2026 16:06
pflynn-virtru added a commit that referenced this pull request Aug 10, 2026
@pflynn-virtru @claude
fix(sdk): bump brace-expansion and js-yaml to patch DoS advisories
e904cc4 
Closes the remaining Dependabot alerts that have no Dependabot PR of
their own:

  brace-expansion  GHSA-3jxr-9vmj-r5cp / CVE-2026-13149 -- DoS via
                   exponential-time expansion of consecutive
                   non-expanding {} groups
                   alerts #292 #297 #298 (lib), #302 #303 (web-app)
  js-yaml          GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 -- quadratic
                   CPU consumption in !!omap resolution
                   alerts #327 #328 (lib)

Both are transitive dev-only dependencies, so this is a lockfile-only
change made with `npm update --package-lock-only`; no package.json
ranges move.

  brace-expansion  1.1.12/1.1.14 -> 1.1.18
                   2.0.2/2.1.0   -> 2.1.4
                   5.0.6/5.0.7   -> 5.0.9
  js-yaml          3.15.0        -> 3.15.1  (lib)
                   4.3.0         -> 4.3.1   (lib)

cli/ carries brace-expansion bumps too. It had no alert of its own --
it was already on 1.1.16/2.1.2/5.0.7 -- but `npm update` moved it onto
the same patched versions as the other two lockfiles.

The js-yaml bumps for cli/ and web-app/ that earlier revisions of this
branch carried have been dropped; they landed via #981 and #983.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Paul Flynn <pflynn-virtru@users.noreply.github.com>
@pflynn-virtru pflynn-virtru mentioned this pull request Aug 10, 2026
Merged
pflynn-virtru added a commit that referenced this pull request Aug 10, 2026
@pflynn-virtru @claude
fix(sdk): bump js-yaml to 3.15.1/4.3.1 in lib to patch omap DoS
010022c 
Closes the last two Dependabot alerts that have no Dependabot PR of
their own:

  js-yaml  GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 -- quadratic CPU
           consumption in !!omap resolution
           alerts #327 #328 (lib)

js-yaml is a transitive dev-only dependency, so this is a lockfile-only
change made with `npm update --package-lock-only`; no package.json
ranges move.

  js-yaml  3.15.0 -> 3.15.1   (via @istanbuljs/load-nyc-config)
           4.3.0  -> 4.3.1

Earlier revisions of this branch also carried brace-expansion bumps for
lib/, cli/ and web-app/, plus js-yaml for cli/ and web-app/. Those all
landed via Dependabot PRs #981, #983, #985 and #995, so they have been
dropped here. cli/ is untouched: it was already on patched
brace-expansion (1.1.16/2.1.2/5.0.7) and never had an alert.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Paul Flynn <pflynn-virtru@users.noreply.github.com>
pflynn-virtru added a commit that referenced this pull request Aug 10, 2026
@pflynn-virtru @claude
fix(sdk): bump js-yaml to 3.15.1/4.3.1 in lib to patch omap DoS (#979)
75b50e0 
Closes the last two Dependabot alerts that have no Dependabot PR of
their own:

  js-yaml  GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 -- quadratic CPU
           consumption in !!omap resolution
           alerts #327 #328 (lib)

js-yaml is a transitive dev-only dependency, so this is a lockfile-only
change made with `npm update --package-lock-only`; no package.json
ranges move.

  js-yaml  3.15.0 -> 3.15.1   (via @istanbuljs/load-nyc-config)
           4.3.0  -> 4.3.1

Earlier revisions of this branch also carried brace-expansion bumps for
lib/, cli/ and web-app/, plus js-yaml for cli/ and web-app/. Those all
landed via Dependabot PRs #981, #983, #985 and #995, so they have been
dropped here. cli/ is untouched: it was already on patched
brace-expansion (1.1.16/2.1.2/5.0.7) and never had an alert.

Signed-off-by: Paul Flynn <pflynn-virtru@users.noreply.github.com>
Co-authored-by: Paul Flynn <pflynn-virtru@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pflynn-virtru pflynn-virtru pflynn-virtru approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pflynn-virtru