From 1f791050bd7d39dba57af6d02d878236f74f91ae Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 23:31:20 +0000 Subject: [PATCH 1/2] chore(deps): bump js-yaml from 4.2.0 to 4.3.1 Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.2.0 to 4.3.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.2.0...4.3.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- package-lock.json | 8 ++++---- package.json | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index c8e31bd..1b24335 100644 --- a/package-lock.json +++ b/package-lock.json @@ -34,7 +34,7 @@ "husky": "9.1.7", "jest": "30.2.0", "jest-circus": "30.2.0", - "js-yaml": "4.2.0", + "js-yaml": "4.3.1", "lint-staged": "16.2.7", "prettier": "3.6.2", "ts-jest": "29.4.5", @@ -7895,9 +7895,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "dev": true, "funding": [ { diff --git a/package.json b/package.json index b1ffd18..e3d9d7e 100644 --- a/package.json +++ b/package.json @@ -33,7 +33,7 @@ "@aws-sdk/client-s3": "3.1019.0", "@smithy/node-http-handler": "4.4.5", "https-proxy-agent": "7.0.6", - "js-yaml": "^4.2.0", + "js-yaml": "^4.3.1", "zod": "^4.1.12" }, "devDependencies": { @@ -54,7 +54,7 @@ "husky": "9.1.7", "jest": "30.2.0", "jest-circus": "30.2.0", - "js-yaml": "4.2.0", + "js-yaml": "4.3.1", "lint-staged": "16.2.7", "prettier": "3.6.2", "ts-jest": "29.4.5", From 8122e20cb4a818c46cc04367bf1d1936f8ee64d5 Mon Sep 17 00:00:00 2001 From: GitHub Actions Date: Mon, 10 Aug 2026 23:31:58 +0000 Subject: [PATCH 2/2] (chore) updating dist --- dist/index.js | 34 +++++++++++++++------------------- 1 file changed, 15 insertions(+), 19 deletions(-) diff --git a/dist/index.js b/dist/index.js index 3a1822f..88f2ccc 100644 --- a/dist/index.js +++ b/dist/index.js @@ -42140,7 +42140,7 @@ function State (input, options) { this.json = options['json'] || false this.listener = options['listener'] || null this.maxDepth = typeof options['maxDepth'] === 'number' ? options['maxDepth'] : 100 - this.maxMergeSeqLength = typeof options['maxMergeSeqLength'] === 'number' ? options['maxMergeSeqLength'] : 20 + this.maxTotalMergeKeys = typeof options['maxTotalMergeKeys'] === 'number' ? options['maxTotalMergeKeys'] : 10000 this.implicitTypes = this.schema.compiledImplicit this.typeMap = this.schema.compiledTypeMap @@ -42151,6 +42151,7 @@ function State (input, options) { this.lineStart = 0 this.lineIndent = 0 this.depth = 0 + this.totalMergeKeys = 0 // position of first leading tab in the current line, // used to make sure there are no tabs in the indentation @@ -42368,6 +42369,10 @@ function mergeMappings (state, destination, source, overridableKeys) { for (let index = 0, quantity = sourceKeys.length; index < quantity; index += 1) { const key = sourceKeys[index] + if (state.maxTotalMergeKeys !== -1 && ++state.totalMergeKeys > state.maxTotalMergeKeys) { + throwError(state, 'merge keys exceeded maxTotalMergeKeys (' + state.maxTotalMergeKeys + ')') + } + if (!_hasOwnProperty.call(destination, key)) { setProperty(destination, key, source[key]) overridableKeys[key] = true @@ -42409,17 +42414,8 @@ function storeMappingPair (state, _result, overridableKeys, keyTag, keyNode, val if (keyTag === 'tag:yaml.org,2002:merge') { if (Array.isArray(valueNode)) { - if (valueNode.length > state.maxMergeSeqLength) { - throwError(state, 'merge sequence length exceeded maxMergeSeqLength (' + state.maxMergeSeqLength + ')') - } - const seen = new Set() for (let index = 0, quantity = valueNode.length; index < quantity; index += 1) { - const src = valueNode[index] - // Existing keys are not overridden on merge, so dedupe sources to - // avoid redundant work on repeated aliases. - if (seen.has(src)) continue - seen.add(src) - mergeMappings(state, _result, src, overridableKeys) + mergeMappings(state, _result, valueNode[index], overridableKeys) } } else { mergeMappings(state, _result, valueNode, overridableKeys) @@ -44378,7 +44374,7 @@ function resolveYamlFloat (data) { return false } - if (Number.isFinite(parseFloat(data, 10))) { + if (isFinite(parseFloat(data, 10))) { return true } @@ -44506,7 +44502,7 @@ function resolveYamlInteger (data) { if (ch !== '0' && ch !== '1') return false hasDigits = true } - return hasDigits && Number.isFinite(parseYamlInteger(data)) + return hasDigits && isFinite(parseYamlInteger(data)) } if (ch === 'x') { @@ -44517,7 +44513,7 @@ function resolveYamlInteger (data) { if (!isHexCode(data.charCodeAt(index))) return false hasDigits = true } - return hasDigits && Number.isFinite(parseYamlInteger(data)) + return hasDigits && isFinite(parseYamlInteger(data)) } if (ch === 'o') { @@ -44528,7 +44524,7 @@ function resolveYamlInteger (data) { if (!isOctCode(data.charCodeAt(index))) return false hasDigits = true } - return hasDigits && Number.isFinite(parseYamlInteger(data)) + return hasDigits && isFinite(parseYamlInteger(data)) } } @@ -44543,7 +44539,7 @@ function resolveYamlInteger (data) { if (!hasDigits) return false - return Number.isFinite(parseYamlInteger(data)) + return isFinite(parseYamlInteger(data)) } function parseYamlInteger (data) { @@ -44694,7 +44690,7 @@ const _toString = Object.prototype.toString function resolveYamlOmap (data) { if (data === null) return true - const objectKeys = [] + const objectKeys = {} const object = data for (let index = 0, length = object.length; index < length; index += 1) { @@ -44713,8 +44709,8 @@ function resolveYamlOmap (data) { if (!pairHasKey) return false - if (objectKeys.indexOf(pairKey) === -1) objectKeys.push(pairKey) - else return false + if (_hasOwnProperty.call(objectKeys, pairKey)) return false + Object.defineProperty(objectKeys, pairKey, { value: true }) } return true