Skip to content

Commit fdff1d8

Browse files
authored
chore(deps): bump js-yaml to ^3.15.1 / ^4.3.1 (#6578)
resolveYamlOmap() deduplicated !!omap keys with a linear indexOf scan inside the per-element loop, so parsing an n-entry ordered map is O(n^2). !!omap is part of the default schema, so a plain yaml.load() is affected. 5.x fixed this in 5.2.1; the backport to the 3.x and 4.x lines only landed now. Both lines are bumped in one go: the global js-yaml resolution covers the 4.x consumers and the three scoped entries keep the 3.x consumers on 3.x. Covers Dependabot alerts 620 and 621: https://github.com/getsentry/sentry-react-native/security/dependabot/621
1 parent c974c52 commit fdff1d8

2 files changed

Lines changed: 12 additions & 12 deletions

File tree

package.json

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -63,10 +63,10 @@
6363
],
6464
"resolutions": {
6565
"appium-chromedriver@npm:8.2.19/@xmldom/xmldom": "0.8.13",
66-
"@istanbuljs/load-nyc-config@npm:1.1.0/js-yaml": "^3.15.0",
67-
"@yarnpkg/parsers@npm:3.0.0-rc.46/js-yaml": "^3.15.0",
68-
"cosmiconfig@npm:5.2.1/js-yaml": "^3.15.0",
69-
"js-yaml": "^4.3.0",
66+
"@istanbuljs/load-nyc-config@npm:1.1.0/js-yaml": "^3.15.1",
67+
"@yarnpkg/parsers@npm:3.0.0-rc.46/js-yaml": "^3.15.1",
68+
"cosmiconfig@npm:5.2.1/js-yaml": "^3.15.1",
69+
"js-yaml": "^4.3.1",
7070
"detox@npm:20.46.0/ajv": "^8.18.0",
7171
"@expo/fingerprint@npm:0.6.1/minimatch": "^3.1.3",
7272
"glob@npm:6.0.4/minimatch": "^3.1.3",

yarn.lock

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20970,26 +20970,26 @@ __metadata:
2097020970
languageName: node
2097120971
linkType: hard
2097220972

20973-
"js-yaml@npm:^3.15.0":
20974-
version: 3.15.0
20975-
resolution: "js-yaml@npm:3.15.0"
20973+
"js-yaml@npm:^3.15.1":
20974+
version: 3.15.1
20975+
resolution: "js-yaml@npm:3.15.1"
2097620976
dependencies:
2097720977
argparse: "npm:^1.0.7"
2097820978
esprima: "npm:^4.0.0"
2097920979
bin:
2098020980
js-yaml: bin/js-yaml.js
20981-
checksum: 10c0/ca966bd354ac5b1b7a4694ebdba46526796aa3a6a99529fa540af2abf85918bd155a50ccc0166b413130a00622999973754458ec01e7095bc902177bfdbd5b64
20981+
checksum: 10c0/6c693b8c59ffe12021df3b36994b090df19d920826dd810baab81652b40861e1974509dd11fe92225ab4c00cc14de053300c94db015c2c0e211edea39b118737
2098220982
languageName: node
2098320983
linkType: hard
2098420984

20985-
"js-yaml@npm:^4.3.0":
20986-
version: 4.3.0
20987-
resolution: "js-yaml@npm:4.3.0"
20985+
"js-yaml@npm:^4.3.1":
20986+
version: 4.3.1
20987+
resolution: "js-yaml@npm:4.3.1"
2098820988
dependencies:
2098920989
argparse: "npm:^2.0.1"
2099020990
bin:
2099120991
js-yaml: bin/js-yaml.js
20992-
checksum: 10c0/058b30473d6915ca5b4feb11e2f7d4d97242f98d00a798ed48dd90b46b7c640398afe9128c5db22c5300f8c6528fe2a174b9a93f351a70ebc28c6203938d8bff
20992+
checksum: 10c0/13c500ca322e0c3f8c81686e6ecda96d2ea37b45247a420c17c7db36932d6965cc27391abc2d1a104501600e7f0d947a5f8b7be6db619c4fefa87901b3512807
2099320993
languageName: node
2099420994
linkType: hard
2099520995

0 commit comments

Comments
 (0)