fix(security): bump js-yaml to 4.3.1 to patch quadratic-CPU DoS (GHSA-5p4m-2wfm-xmqj) - #760
Open
fro-bot wants to merge 1 commit into
Open
fix(security): bump js-yaml to 4.3.1 to patch quadratic-CPU DoS (GHSA-5p4m-2wfm-xmqj)#760fro-bot wants to merge 1 commit into
fro-bot wants to merge 1 commit into
Conversation
Direct dependency js-yaml resolved to 4.3.0, which is affected by GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 (High, CVSS 7.5): O(n^2) key-uniqueness scan in !!omap resolution allows a small malicious YAML document to block the event loop for seconds. js-yaml is used directly in src/lib/frontmatter.ts to parse skill/agent/command frontmatter. 4.3.1 contains the fix (Set-based key tracking, same approach as the 5.x line) and satisfies the existing ^4.1.1 semver range in package.json, so no source changes are required. This is a lockfile-scoped patch bump, independent of the pending major-version PR #733 (js-yaml v5), which additionally requires an import-shape fix for the dropped default export and is left to Renovate/category-1 repair. Verified: typecheck, lint, bun test tests/unit (1827 pass), build, content-integrity, and the ESM default-export smoke test all pass on this branch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the direct
js-yamldependency from4.3.0(resolved) to4.3.1to patch a High severity advisory: GHSA-5p4m-2wfm-xmqj (CVE-2026-59870 fix not backported to 3.x/4.x), CVSS 3.1 7.5.Why this is the right fix
src/lib/frontmatter.tsimportsjs-yamldirectly to parse skill/agent/command frontmatter withyaml.load(..., { schema: yaml.JSON_SCHEMA }).resolveYamlOmap()does an O(n) linear scan (indexOf) per element for key-uniqueness in!!omapsequences, making!!omapresolution O(n^2).!!omapis in the default schema, so anyyaml.load()call is affected -- no custom options required. A ~2.5MB crafted YAML document can block the event loop for ~10s.>= 4.0.0, < 4.3.1and>= 3.0.0, < 3.15.1. Patched:4.3.1/3.15.1(same fix already shipped in the 5.x line since 5.2.1, ported back to the legacy lines in 4.3.1).4.3.1satisfies the existing^4.1.1semver range inpackage.json-- no source changes required, so this is a lockfile-scoped patch bump.Relationship to #733
This is intentionally not the same fix as #733 (
renovate/js-yaml-5.x), which is a major-version bump to js-yaml v5. That PR is currently failing CI because v5 dropped the default export thatsrc/lib/frontmatter.tsrelies on (import yaml from 'js-yaml'), requiring a source-level import fix. This PR takes the smaller, immediately-safe path: patch within the current major to close the security gap now, independent of the larger (Renovate-owned) major-version migration.Scope
Per repo dependency-ownership conventions, this PR touches
js-yamlonly -- no other dependency versions were changed.Verification (on this branch)
bun run typecheck-- cleanbun run lint-- clean (pre-existing unrelated warnings only)bun test tests/unit-- 1827 pass, 0 failbun run build-- succeedsbun scripts/content-integrity.ts-- cleannode --input-type=module -e "import('./dist/index.js').then(m => console.log(Object.keys(m).sort()))"->['default']Opened by Fro Bot (category 2: Security) during the daily autoheal pass.