[mtrezza]

Closes #940

Updates both js-yaml copies in the lock file to the newest release of their major version line:

• js-yaml 3.14.2 → 3.15.2, used by @istanbuljs/load-nyc-config (via nyc)
• js-yaml 4.1.1 → 4.3.2, used by cosmiconfig (via semantic-release)

This resolves the open js-yaml security alerts in both version lines (GHSA-2883-xcg3-v3hh, GHSA-5p4m-2wfm-xmqj, GHSA-52cp-r559-cp3m, GHSA-h67p-54hq-rp68). Both copies are development-only dependencies (npm ls js-yaml --omit=dev is empty), so no release is needed.

The lock file was regenerated with npm update js-yaml on the current master. Only the two js-yaml entries change. The lock file in #940 is stale; it also moved the 4.x copy to 4.3.2, but additionally pruned the optional peer entries gaxios, gcp-metadata and node-fetch (under parse-server), smart-buffer and socks. This lock file keeps them, as on master.

Changes

js-yaml 3.14.2 → 3.15.2

• 3.15.0: Added the maxTotalMergeKeys loader option (default 10000), which limits the total number of keys processed by YAML merge (<<) in one load call. The release notes mention safeLoad() / safeLoadAll(), but the default is set in the shared loader state, so it also applies to load() / loadAll(). Exceeding it throws merge keys exceeded maxTotalMergeKeys (10000).
• 3.15.1: Security: Removed quadratic complexity from !!omap duplicate key detection.
• 3.15.2: Merge sequences (<<: [...]) are hard-limited to 100 entries; more throws abnormal merge sequence size. Security: mergeMappings() now charges one unit toward maxTotalMergeKeys for each merged source mapping, empty or not, before counting its keys (fix: count empty merge sources against maxTotalMergeKeys nodeca/js-yaml#797, nodeca/js-yaml@3485bc0). This applies to merge sequences and to single <<: *anchor merges, so documents with many merges reach the 10000 limit slightly sooner.

js-yaml 4.1.1 → 4.3.2

• 4.2.0:
  • Added the maxDepth loader option (default 100). Nesting 100 levels deep throws nesting exceeded maxDepth (100).
  • Added the maxMergeSeqLength loader option (default 20). It was replaced by maxTotalMergeKeys in 4.3.0.
  • Numbers with underscores are no longer resolved as numeric scalars, Parsing numbers according to YAML 1.2 nodeca/js-yaml#627. For example, 1_000 now loads as the string "1_000" instead of 1000.
  • Fixed parsing of properties (tags, anchors) on the first implicit block mapping key, [reader] Reading of properties on implicit block mapping keys. nodeca/js-yaml#62. Documents such as !!str 16: 32, which previously failed to load, now load.
  • Fixed trailing whitespace handling when folding multi-line quoted scalars, Example 7.5 "Double Quoted Line Breaks" of the 1.2 spec is not parsed properly nodeca/js-yaml#307. Whitespace at the end of a line inside a multi-line single- or double-quoted scalar is no longer kept in the value.
  • Top-level block scalars without content indentation are now rejected, Loader must throw an error on zero-indentation block scalar nodeca/js-yaml#280. A document-root | / > scalar without an indentation indicator, whose first content line is not indented, throws missing indentation for block scalar.
  • Numbers now survive round-trip, Can't round-trip out-of-range floating point nodeca/js-yaml#737. A plain scalar in number syntax whose value is not finite (e.g. 1e400) now loads as a string instead of Infinity; .inf and .nan are unchanged.
  • Fixed digits in YAML named tag handles (e.g. %TAG !e1! ...).
  • Security: Fixed a potential DoS via quadratic complexity in merge, by deduplicating repeated merge sources. 4.3.0 replaced this with maxTotalMergeKeys.
  • Docs and chores: added docs/safety.md, added sourcemaps to dist/ builds, switched dev toolchains to Vite / neostandard, updated the demo, reorganized tests, fixed test coverage for Extra new line added nodeca/js-yaml#221, and stopped keeping dist/ in the repository.
• 4.3.0: Added the maxTotalMergeKeys loader option (default 10000), replacing maxMergeSeqLength. Exceeding it throws merge keys exceeded maxTotalMergeKeys (10000). Restored ES5 UMD builds.
• 4.3.1: Security: Removed quadratic complexity from !!omap duplicate key detection.
• 4.3.2: Merge sequences (<<: [...]) are hard-limited to 100 entries; more throws abnormal merge sequence size. Security: mergeMappings() now charges one unit toward maxTotalMergeKeys for each merged source mapping, empty or not, before counting its keys (fix: count empty merge sources against maxTotalMergeKeys nodeca/js-yaml#797, nodeca/js-yaml@d90b661). This applies to merge sequences and to single <<: *anchor merges, so documents with many merges reach the 10000 limit slightly sooner.

The 4.2.0 changes alter how some YAML documents parse, but they don't reach this repository. Both parents call load() only when they read a YAML config file, and this repository has none:

• cosmiconfig (semantic-release config) parses YAML only for .releaserc, .releaserc.yaml / .yml, .config/releaserc*, package.yaml and .config/config.yaml / .yml. This repository uses release.config.js, and .releaserc is a template directory.
• @istanbuljs/load-nyc-config parses YAML only for .nycrc.yml / .yaml. This repository's .nycrc is JSON.

Breaking Changes

None

Code Changes Required

None — the upgrade is a drop-in replacement.

Summary by CodeRabbit

• Chores
  • Updated the YAML parsing package in the project’s dependency tree.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 5ca6229c-2ba7-466e-ba7e-faac450352a6

Commits

Reviewing files that changed from the base of the PR and between 21cc0fb and b01723e.

Files selected for processing: 1

• package-lock.json

Included review availability: This review used your included allowance. Your plan provides up to 5 included reviews per hour; 3 remain after this review.

Walkthrough

The lockfile updates js-yaml v3 from 3.14.2 to 3.15.2 and js-yaml v4 from 4.1.1 to 4.3.2. It records updated package URLs and integrity hashes, and adds a license field to the v3 entry.

Changes: js-yaml dependency update

Layer / File(s)	Summary
Update js-yaml lock entries package-lock.json	The lockfile updates the v3 and v4 package versions, URLs, and integrity hashes. The v3 entry also gains an MIT license field.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: Minimal · up to b0172

No actionable merge-blocking risk remains in this lockfile-only dependency update.

Pre-merge checks: 7

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title begins with the required prefix "refactor:" and the first letter after the prefix is capitalized ("Bump"). It also describes the main change, which bumps js-yaml from 3.14.2 to 3.15.2 and fr…
Linked Issues check		Directly linked issue #940 has one coding requirement: upgrade js-yaml from 3.14.2 to 3.15.2. The lock file diff (base to head) meets it. The nested entry node_modules/@istanbuljs/load-nyc-config/node…
Out of Scope Changes check		The diff touches only package-lock.json. The changes are limited to js-yaml entries: the 3.x copy under @istanbuljs/load-nyc-config, the top-level 4.x copy, and their legacy dependencies-section count…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check		PASS. The pull request changes only package-lock.json. It replaces js-yaml 3.14.2 with 3.15.2 and 4.1.1 with 4.3.2, with updated registry URLs and integrity hashes. Both entries remain marked as devel…
Engage In Review Feedback		PASS — The supplied review data shows zero actionable findings and no posted CodeRabbit review threads. Therefore, no review feedback required engagement, implementation, or reviewer retraction.

Full details: Title check

Explanation

The title begins with the required prefix "refactor:" and the first letter after the prefix is capitalized ("Bump"). It also describes the main change, which bumps js-yaml from 3.14.2 to 3.15.2 and from 4.1.1 to 4.3.2 in the lock file. The title meets the title requirements and matches the changeset.

Full details: Linked Issues check

Explanation

Directly linked issue #940 has one coding requirement: upgrade js-yaml from 3.14.2 to 3.15.2. The lock file diff (base to head) meets it. The nested entry node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml now resolves to version 3.15.2 with the matching tarball URL and integrity hash. The legacy dependencies section entry for the same nested package also moves to 3.15.2. The issue's changelog-derived behavior (maxTotalMergeKeys, merge-sequence limits, !!omap fix) is a property of the upstream library. The issue sets no repository-level acceptance criteria. No automated test change is required for a lock-only dependency bump, and the existing CI covers the dependency. The PR also moves the top-level js-yaml to 4.3.2. That change is outside #940 but does not conflict with its requirement. Only lock file entries changed. No package.json change was needed, because js-yaml is transitive. Residual uncertainty: the full lock file was not read, so no other 3.14.2 copy was checked. The diff shows only the two js-yaml copies changed.

Full details: Out of Scope Changes check

Explanation

The diff touches only package-lock.json. The changes are limited to js-yaml entries: the 3.x copy under @istanbuljs/load-nyc-config, the top-level 4.x copy, and their legacy dependencies-section counterparts. The 4.x bump (4.1.1 to 4.3.2) is not part of #940, which covers only 3.x. It is still connected to the same package and the same stated purpose, the js-yaml security remediation, as described in the PR text and objectives. It does not touch unrelated dependencies or source files. Also, the claim that the 4.x parsing changes do not reach this repository is supported by the file list at head. No .nycrc.yml or .nycrc.yaml exists, only a .nycrc. No .releaserc.yaml, .releaserc.yml, or .config/ directory exists. .releaserc is a directory of templates, and release.config.js is used. The added license and funding metadata are npm regeneration output for the same packages. They are not unrelated changes.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Security Check

Explanation

PASS. The pull request changes only package-lock.json. It replaces js-yaml 3.14.2 with 3.15.2 and 4.1.1 with 4.3.2, with updated registry URLs and integrity hashes. Both entries remain marked as development dependencies. No application code, configuration logic, scripts, or executable security-sensitive patterns changed.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[parseplatformorg]

🎉 This change has been released in version 3.1.0