[MelvinBot]

Details

Lockfile-only bump of transitive dev dependency js-yaml to fix open Dependabot alerts (GHSA-2883-xcg3-v3hh, GHSA-5p4m-2wfm-xmqj, GHSA-52cp-r559-cp3m, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m):

• 4.1.1 → 4.3.2 (hoisted)
• 3.14.1 → 3.15.2 (nested under cosmiconfig and @istanbuljs/load-nyc-config)

Both stay within existing semver ranges (^4.1.1, ^3.13.1). package.json is unchanged.

Usage: Onyx doesn't import js-yaml. It's dev-only, used to parse YAML config files by:

• @eslint/eslintrc (ESLint)
• @istanbuljs/load-nyc-config (Jest coverage via babel-plugin-istanbul)
• cosmiconfig (via React Native's metro-config)

It isn't shipped in the published dist/ package.

Change Log

4.3.2 (2026-08-26)

• [backport] Hard-limit merge sequence size to 100.
• Security: [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage.

4.3.1 (2026-07-31)

• Security: [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 (2026-06-27)

• Added: [backport] maxTotalMergeKeys (10000) loader option.
• Fixed: Restore umd builds back to es5.
• Removed: [backport] maxMergeSeqLength, replaced with maxTotalMergeKeys.

4.2.0 (2026-06-01)

• Added: maxDepth (100) loader option, maxMergeSeqLength (20) loader option, docs/safety.md, sourcemaps in dist/.
• Changed: Stop resolving numbers with underscores as numeric scalars.
• Fixed: Several parser fixes (implicit block mapping key properties, flow scalar whitespace folding, top-level block scalar indentation, number round-trip, digits in tag handles).
• Security: Fix potential DoS via quadratic complexity in merge.

3.15.2 (2026-08-26)

• [backport] Hard-limit merge sequence size to 100.
• Security: [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys.

3.15.1 (2026-07-31)

• Security: [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 (2026-06-27)

• Added: maxTotalMergeKeys (10000) loader option.

3.14.2 (2025-11-15)

• Security: Fix prototype pollution in merge (<<).

Related Issues

$ https://github.com/Expensify/Expensify/issues/695666

Linked E/App PR

N/A: dev-only lockfile change, so the published package is unchanged.

Automated Tests

None added. This is a dependency bump with no code changes, so existing CI (lint, typecheck, Jest) covers it.

Manual Tests

1. Run npm ci. Verify it succeeds with no lockfile errors. ✅
2. Run npm ls js-yaml. Verify it lists only 4.3.2 and 3.15.2.

react-native-onyx (claude-bumpJsYaml) npm ls js-yaml                                                                  ✱
[email protected] /Users/neilmarcellini/Expensidev/react-native-onyx
├─┬ [email protected]
│ └─┬ @eslint/[email protected]
│   └── [email protected]
└─┬ [email protected]
  ├─┬ @react-native/[email protected]
  │ └─┬ [email protected]
  │   └─┬ [email protected]
  │     └── [email protected]
  └─┬ [email protected]
    └─┬ [email protected]
      └─┬ @istanbuljs/[email protected]
        └── [email protected]

➜  react-native-onyx (claude-bumpJsYaml)  

3. Run npm run lint. Verify ESLint loads its config and passes.

➜  react-native-onyx (claude-bumpJsYaml) npm run lint                                                                    ✱

> [email protected] lint
> eslint .

➜  react-native-onyx (claude-bumpJsYaml)       

4. Run npx jest --coverage. Verify the tests pass and the coverage report is generated.

-----------------------------------------|---------|----------|---------|---------|----------------------------------------
File                                     | % Stmts | % Branch | % Funcs | % Lines | Uncovered Line #s                      
-----------------------------------------|---------|----------|---------|---------|----------------------------------------
All files                                |   90.02 |    85.26 |   87.03 |   90.23 |                                        
 lib                                     |   93.97 |    89.77 |   95.42 |   93.92 |                                        
  DevTools.ts                            |     100 |       20 |     100 |     100 | 12-34                                  
  Logger.ts                              |     100 |      100 |     100 |     100 |                                        
  Onyx.ts                                |    98.5 |    92.64 |   98.46 |    98.4 | 153,379-380,613                        
  OnyxCache.ts                           |   98.79 |    97.87 |     100 |   98.78 | 207,570                                
  OnyxKeys.ts                            |     100 |    95.45 |     100 |     100 | 123                                    
  OnyxSubscriptionManager.ts             |   98.71 |    96.82 |   94.11 |   98.64 | 41                                     
  OnyxUtils.ts                           |   87.76 |    82.96 |   90.83 |   87.69 | ...,1400-1401,1422,1461,1616,1689-1691 
  PendingWrites.ts                       |     100 |      100 |     100 |     100 |                                        
  StateMachine.ts                        |   85.71 |       50 |     100 |   85.71 | 55                                     
  StorageCircuitBreaker.ts               |     100 |      100 |     100 |     100 |                                        
  createDeferredTask.ts                  |     100 |      100 |     100 |     100 |                                        
  index.ts                               |       0 |        0 |       0 |       0 |                                        
  logMessages.ts                         |     100 |       50 |     100 |     100 | 3                                      
  useOnyx.ts                             |   97.22 |    95.83 |     100 |   96.87 | 81                                     
  utils.ts                               |   96.49 |    95.76 |   91.66 |   96.46 | 319-322,352                            
 lib/CircuitBreaker                      |   98.18 |    84.61 |     100 |   98.18 |                                        
  AbstractCircuitBreaker.ts              |   98.14 |    84.61 |     100 |   98.14 | 158                                    
  types.ts                               |     100 |      100 |     100 |     100 |                                        
 lib/DevTools                            |    86.2 |    66.66 |      70 |   85.71 |                                        
  NoOpDevTools.ts                        |       0 |        0 |       0 |       0 |                                        
  RealDevTools.ts                        |    86.2 |    66.66 |     100 |   85.71 | 32-34,57,70                            
 lib/OnyxMerge                           |     100 |      100 |     100 |     100 |                                        
  index.ts                               |     100 |      100 |     100 |     100 |                                        
 lib/storage                             |   54.45 |    61.81 |   47.91 |   60.46 |                                        
  errors.ts                              |     100 |    82.35 |     100 |     100 | 44,57-58                               
  index.ts                               |   48.88 |    52.63 |   45.65 |   54.66 | 41,97,120,130-206,217-222              
 lib/storage/InstanceSync                |      86 |    88.88 |      50 |   85.71 |                                        
  index.ts                               |      50 |      100 |       0 |      50 | 18                                     
  index.web.ts                           |    87.5 |    88.88 |   58.33 |   87.23 | 48,90,141-150                          
 lib/storage/platforms                   |       0 |        0 |       0 |       0 |                                        
  index.native.ts                        |       0 |        0 |       0 |       0 |                                        
 lib/storage/providers                   |   85.42 |    71.42 |   82.02 |   83.85 |                                        
  MemoryOnlyProvider.ts                  |   90.47 |       75 |    90.9 |   89.74 | 31,86,132,163                          
  NoopProvider.ts                        |    7.14 |      100 |       0 |    7.14 | 16-108                                 
  SQLiteProvider.ts                      |   89.56 |    67.07 |     100 |   88.19 | ...277,330,342,353,360,367,371,400,407 
  classifySQLiteError.ts                 |     100 |      100 |     100 |     100 |                                        
 lib/storage/providers/IDBKeyValProvider |   83.42 |    75.63 |   92.15 |   82.96 |                                        
  classifyError.ts                       |     100 |      100 |     100 |     100 |                                        
  createStore.ts                         |   83.51 |    71.42 |    90.9 |   83.14 | 52,78-93,126,139,149                   
  errorMessages.ts                       |     100 |      100 |     100 |     100 |                                        
  index.ts                               |   78.66 |    63.04 |   92.59 |   77.77 | ...137,143-147,151,162,172,184,188,199 
  isIndexedDBAvailable.ts                |     100 |      100 |     100 |     100 |                                        
 tests/utils                             |     100 |      100 |     100 |     100 |                                        
  waitForPromisesToResolve.ts            |     100 |      100 |     100 |     100 |                                        
-----------------------------------------|---------|----------|---------|---------|----------------------------------------

Test Suites: 23 passed, 23 total
Tests:       707 passed, 707 total
Snapshots:   0 total
Time:        3.261 s
Ran all test suites.
➜  react-native-onyx (claude-bumpJsYaml)                                                                                 ✱

5. Run npm run build. Verify the build succeeds.

➜  react-native-onyx (claude-bumpJsYaml) npm run build                                                                   ✱

> [email protected] build
> tsc -p tsconfig.build.json

➜  react-native-onyx (claude-bumpJsYaml)   

Author Checklist

• I linked the correct issue in the ### Related Issues section above
• I linked the corresponding Expensify/App PR in the ### Linked E/App PR section above, and verified this change against it (E/App CI passed and manual testing completed)
• I wrote clear testing steps that cover the changes made in this PR
  • I added steps for local testing in the Tests section
  • I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).
• I included screenshots or videos for tests on all platforms
• I ran the tests on all platforms & verified they passed on:
  • Android / native
  • Android / Chrome
  • iOS / native
  • iOS / Safari
  • MacOS / Chrome / Safari
• I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
• I followed proper code patterns (see Reviewing the code)
  • I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick)
  • I verified that the left part of a conditional rendering a React component is a boolean and NOT a string, e.g. myBool && <MyComponent />.
  • I verified that comments were added to code that is not self explanatory
  • I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
  • I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
  • I verified the JSDocs style guidelines (in STYLE.md) were followed
• If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
• I followed the guidelines as stated in the Review Guidelines
• I tested other components that can be impacted by my changes (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar are working as expected)
• I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
• I verified any variables that can be defined as constants (ie. in CONST.js or at the top of the file that uses the constant) are defined as such
• I verified that if a function's arguments changed that all usages have also been updated correctly
• If a new component is created I verified that:
  • A similar component doesn't exist in the codebase
  • All props are defined accurately and each prop has a /** comment above it */
  • The file is named correctly
  • The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
  • The only data being stored in the state is data necessary for rendering and nothing else
  • If we are not using the full Onyx data that we loaded, I've added the proper selector in order to ensure the component only re-renders when the data it is using changes
  • For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
  • Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
  • All JSX used for rendering exists in the render method
  • The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
• If any new file was added I verified that:
  • The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
• If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
• If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
• I have checked off every checkbox in the PR author checklist, including those that don't apply to this PR.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T13:06:43.582355Z	f5227d0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[neil-marcellini]

(Neil's AI agent)

The validate-checklist check is failing only because it requires the "Linked E/App PR" section to contain an Expensify/App PR URL. This PR only bumps js-yaml in the lockfile. That's a dev-only dependency, so the published Onyx package doesn't change and there's nothing to test in E/App. The Author Checklist itself passes. This failure is expected and can be ignored.

[os-botify]

🚀 Published to npm in 3.0.140 🎉

[melvin-bot]

@neil-marcellini looks like this was merged without a test passing. These checks had not passed on f5227d0 when it was merged:

• validate-checklist (failure)

Please add a note explaining why this was done and remove the Emergency label if this is not an emergency.