Skip to content

chore(deps): bump js-yaml from 4.1.1 to 4.3.0#4286

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/js-yaml-4.2.0
Open

chore(deps): bump js-yaml from 4.1.1 to 4.3.0#4286
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/js-yaml-4.2.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps js-yaml from 4.1.1 to 4.3.0.

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

  • Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
  • Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

  • maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

  • Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

  • Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

  • [breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

  • Added named exports for schemas, tags, parser events and AST utilities.
  • Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.
  • Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.
  • Added dump() transform option for changing the generated AST before rendering.
  • Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.
  • Added formal data layers (events and AST) for modular data pipelines.
    • Added low-level parser (to events), presenter and visitor APIs.
  • Added the YAML Test Suite to the test set.

Changed

  • See the migration guide for upgrade notes.
  • Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • 6842ef6 doc polish
  • 590dbab 4.2.0 released
  • f944dc5 Add package.json funding field
  • f692719 Changelog update
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 1, 2026
@CLAassistant

CLAassistant commented Jul 1, 2026

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@github-actions

github-actions Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

  • feat: add user authentication (CM-123)
  • feat: add user authentication (IN-123)

Projects:

  • CM: Community Data Platform
  • IN: Insights

Please add a Jira issue key to your PR title.

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/js-yaml-4.2.0 branch from d1f11ba to 659bd74 Compare July 2, 2026 10:09
@dependabot dependabot Bot changed the title chore(deps): bump js-yaml from 4.1.1 to 4.2.0 chore(deps): bump js-yaml from 4.1.1 to 4.3.0 Jul 22, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/js-yaml-4.2.0 branch from 659bd74 to 6110e57 Compare July 22, 2026 11:07
@cursor

cursor Bot commented Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown

PR Summary

Low Risk
Patch-level dependency bump with no application code changes; main review surface is lockfile breadth and YAML parsing behavior for untrusted inputs.

Overview
Bumps js-yaml to ^4.3.0 (resolved 4.3.0) in cron_service, packages_worker, and security_best_practices_worker, with pnpm-lock.yaml updated accordingly.

4.3.0 is a security-focused patch on the v4 line (e.g. maxTotalMergeKeys for YAML merge << handling). Workers that load YAML—OpenStack repo groups, security-insights extraction, security best practices—pick up that hardening without source changes.

The lockfile also reflects transitive resolution shifts (e.g. @modelcontextprotocol/sdk / ajv, Express 5-related pins, clearbit needle git URL format); those are dependency-graph updates, not app logic.

Reviewed by Cursor Bugbot for commit b61420e. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/js-yaml-4.2.0 branch from 6110e57 to 35425e0 Compare July 23, 2026 08:56
@dependabot
chore(deps): bump js-yaml from 4.1.1 to 4.3.0
b61420e 
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.3.0.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.1...4.3.0)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/js-yaml-4.2.0 branch from 35425e0 to b61420e Compare July 26, 2026 13:41
cursor[bot]
cursor Bot reviewed Jul 26, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit b61420e. Configure here.

Comment thread pnpm-lock.yaml
needle@https://codeload.github.com/clearbit/needle/tar.gz/84d28b5f2c3916db1e7eb84aeaa9d976cc40054b:
resolution: {tarball: https://codeload.github.com/clearbit/needle/tar.gz/84d28b5f2c3916db1e7eb84aeaa9d976cc40054b}
needle@git+https://git@github.com:clearbit/needle.git#84d28b5f2c3916db1e7eb84aeaa9d976cc40054b:
resolution: {commit: 84d28b5f2c3916db1e7eb84aeaa9d976cc40054b, repo: git@github.com:clearbit/needle.git, type: git}

@cursor cursor Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lockfile forces SSH git install

High Severity

As a side effect of regenerating pnpm-lock.yaml, the clearbit transitive needle dependency changed from a public HTTPS tarball resolution to an SSH git resolution (repo: git@github.com:...). CI and Docker installs use pnpm i --frozen-lockfile / pnpm fetch without SSH GitHub credentials, so dependency install can fail even though this PR only intended to bump js-yaml.

Additional Locations (2)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit b61420e. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@CLAassistant