build(deps-dev): bump js-yaml from 4.3.0 to 4.3.2 - #934
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
✅ Deploy Preview for phillips-seldon ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
davidicus
left a comment
davidicus
left a comment
There was a problem hiding this comment.
@dependabot squash and merge
![phillips-pr-review-agent[bot]](https://avatars.githubusercontent.com/u/12517380?s=60&v=4){kind=small}
There was a problem hiding this comment.
Security dependency update — approved ✅
This is a Dependabot-generated security bump of js-yaml from 4.3.0 → 4.3.2 (dev-only dependency). The changes are correct and safe to merge.
What's being fixed
Both releases patch CPU-exhaustion / denial-of-service vulnerabilities in YAML parsing:
| Version | Fix |
|---|---|
| 4.3.1 | Removes quadratic complexity from !!omap duplicate key detection — O(n²) input could stall the parser on a crafted document |
| 4.3.2 | Hard-limits merge sequence size to 100; counts empty mappings toward maxTotalMergeKeys to prevent a CPU-burn vector via deeply nested YAML merge keys (#797) |
Impact on this repo
js-yaml is a devDependency in seldon — it is not included in the published @phillips/seldon npm package (confirmed: "dev": true in package-lock.json, not listed in package.json dependencies). It's pulled in transitively by tooling in the build/lint/test chain (likely via markdownlint-cli, semantic-release, or similar). The fix is still worth applying since a compromised CI/build environment could affect published artefacts.
Diff assessment
- Only change:
package-lock.jsonversion + resolved URL + integrity hash fornode_modules/js-yaml— exactly what's expected for a lock-file-only dependency update. package.jsonis untouched — correct;js-yamlis a transitive dev dep, not a direct one.- No source code, no SCSS, no component logic modified.
Merge when CI is green.
|
Tip All tests passed and all changes approved!🟢 UI Tests: 490 tests unchanged |
|
🚀 Storybook preview is ready. • Preview: undefined |
Dependency Upgrade Risk Assessment:
|
| Factor | Assessment |
|---|---|
| Version delta | Patch bump only (4.3.0 → 4.3.2) |
| Dependency type | devDependency — not shipped to production |
| Usage in codebase | Transitive only — zero direct imports in source files |
| Nature of changes | Internal algorithm limits; no API or behavior changes for valid YAML |
| Breaking changes | None noted |
| Blast radius | Limited to build/CI tooling only (Storybook, linting, release pipeline) |
The only realistic regression risk is if some build tool was relying on parsing malformed or deeply-nested YAML that now hits the new limits — which is extremely unlikely in a standard development workflow.
Regression Test Checklist
Before merging, verify the build toolchain is unaffected:
-
npm run build— component library builds successfully -
npm run build:storybook— Storybook static build completes without errors -
npm run start— Storybook dev server starts and renders components correctly -
npm run test— full unit test suite passes -
npm run lint— ESLint, TypeScript, and Stylelint all pass clean -
npm run coverage— coverage thresholds remain at or above 80% - Verify CI pipeline passes end-to-end (all GitHub Actions checks green)
Generated by Claude Code
2 participants
Bumps js-yaml from 4.3.0 to 4.3.2.
Changelog
Sourced from js-yaml's changelog.
Commits
79ca68d4.3.2 releasedd90b661Backport merge limits from v5.4.186e91b84.3.1 releasedc3cc4b0Backport quadratic complexity fix for !!omapDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.