Skip to content

fix(security): resolve js-yaml advisory and clear-text env logging#244

Merged
rsaz merged 2 commits into
mainfrom
fix/security-16-06-2026
Jun 16, 2026
Merged

fix(security): resolve js-yaml advisory and clear-text env logging#244
rsaz merged 2 commits into
mainfrom
fix/security-16-06-2026

Conversation

@rsaz

@rsaz rsaz commented Jun 16, 2026

Copy link
Copy Markdown
Member

Pin transitive js-yaml to 4.2.0 via npm overrides (dev toolchain only). Replace debug dump of the full env object with key names only.

Pull Request Guidelines

Our guidelines for submitting a pull request.

Before submitting a Pull Request, please make sure you have verified the following:

  • The commit message follows our guidelines:
    • A good commit message should be two things: meaningful and concise. It should not contain every single detail, describing each changed line—we can see all the changes in Git—but, at the same time, it should say enough to avoid ambiguity.
    • We use Microverse's commit message convention
    • The convention stablish that a commit message has to be in the present tense, imperative and lowercase.
    • Example: fix typo in README.md
  • Tests for the changes have been added (for bug fixes / features)
  • Docs have been added / updated (for bug fixes / features)

PR Type

What kind of change does this PR introduce?

  • Bugfix
  • Feature
  • Code style update (formatting, local variables)
  • Refactoring (no functional changes, no api changes)
  • Build related changes
  • CI related changes
  • Other... Please describe:

What is the current behavior?

Please describe the current behavior that you are modifying, or link to a relevant issue.

Issue Number: N/A

What is the new behavior?

Describe the new behavior or link to a relevant issue.

Does this PR introduce a breaking change?

  • Yes
  • No

If this PR contains a breaking change, please describe the impact and migration path for existing applications below.

Other information

Any other information that is important to this PR.

Pin transitive js-yaml to 4.2.0 via npm overrides (dev toolchain only).
Replace debug dump of the full env object with key names only.

Co-authored-by: Cursor <cursoragent@cursor.com>
@rsaz rsaz self-assigned this Jun 16, 2026
@rsaz rsaz added the dependencies Pull requests that update a dependency file label Jun 16, 2026
@rsaz rsaz moved this to 👀 In review in Expressots Project Jun 16, 2026
@codecov-commenter

codecov-commenter commented Jun 16, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.59%. Comparing base (a6a9d22) to head (248c231).

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #244      +/-   ##
==========================================
+ Coverage   86.48%   86.59%   +0.10%     
==========================================
  Files           6        6              
  Lines         259      261       +2     
  Branches       59       60       +1     
==========================================
+ Hits          224      226       +2     
  Misses         33       33              
  Partials        2        2              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

The js-yaml override regen dropped a required lockfile node for
@release-it/conventional-changelog, breaking npm ci on GitHub Actions.

Co-authored-by: Cursor <cursoragent@cursor.com>
@rsaz rsaz merged commit 3a0eb89 into main Jun 16, 2026
5 checks passed
@github-project-automation github-project-automation Bot moved this from 👀 In review to ✅ Done in Expressots Project Jun 16, 2026
@rsaz rsaz deleted the fix/security-16-06-2026 branch June 16, 2026 07:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

Status: ✅ Done

Development

Successfully merging this pull request may close these issues.

2 participants