golem15/msd-core
4
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

chore(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 in the npm_and_yarn group across 1 directory (#4565)

Browse Source 
* chore(deps-dev): bump js-yaml

Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).


Updates `js-yaml` from 4.3.1 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.3.1...4.3.2)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore: refresh vendored js-yaml to 4.3.2 (#4565)

lint-vendored-deps caught the drift: this PR's lockfile-only bump left
gsd-core/bin/lib/vendor/js-yaml.cjs and the package.json pin behind the
new js-yaml 4.3.2 resolved by package-lock.json (merge-key CPU-limit
backport, GHSA for excessive merge-key processing). Refreshes the
vendored copy from node_modules and bumps the manifest pin to match.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs: add Security changeset for js-yaml 4.3.2 vendor bump (#4565)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tom Boucher <trekkie@nomorestars.com>
Co-authored-by: sim <sim@local>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
dependabot[bot]
2026-09-09 11:46:35 -04:00
committed by GitHub
parent 6bd5c22f68
commit c504e715c6
4 changed files with 20 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
gsd-core/bin/lib/vendor/js-yaml.cjs vendored
View File

@@ -1262,16 +1262,21 @@
state.result += _result;
}
}
function chargeMergeWork(state) {
state.totalMergeKeys++;
if (state.maxTotalMergeKeys !== -1 && state.totalMergeKeys > state.maxTotalMergeKeys) {
throwError(state, "merge keys exceeded maxTotalMergeKeys (" + state.maxTotalMergeKeys + ")");
}
}
function mergeMappings(state, destination, source, overridableKeys) {
if (!common2.isObject(source)) {
throwError(state, "cannot merge mappings; the provided source object is unacceptable");
}
chargeMergeWork(state);
var sourceKeys = Object.keys(source);
for (var index = 0, quantity = sourceKeys.length; index < quantity; index += 1) {
var key = sourceKeys[index];
if (state.maxTotalMergeKeys !== -1 && ++state.totalMergeKeys > state.maxTotalMergeKeys) {
throwError(state, "merge keys exceeded maxTotalMergeKeys (" + state.maxTotalMergeKeys + ")");
}
chargeMergeWork(state);
if (!_hasOwnProperty.call(destination, key)) {
setProperty(destination, key, source[key]);
overridableKeys[key] = true;
@@ -1299,6 +1304,9 @@
}
if (keyTag === "tag:yaml.org,2002:merge") {
if (Array.isArray(valueNode)) {
if (valueNode.length > 100) {
throwError(state, "abnormal merge sequence size");
}
for (var _index = 0, _quantity = valueNode.length; _index < _quantity; _index += 1) {
mergeMappings(state, _result, valueNode[_index], overridableKeys);
}