chore(deps): bump js-yaml to 4.3.1 in sim-cli and drop the aged-out release-age waivers - #6784
Conversation
…elease-age waivers js-yaml < 4.3.1 has quadratic CPU consumption in !!omap resolution (GHSA-5p4m-2wfm-xmqj / CVE-2026-59870). sim-cli builds with --packages=bundle, so its dev-scoped js-yaml is bundled into the published CLI. 4.3.1 is already what apps/sim pins, so this collapses sim-cli onto the hoisted copy. The minimumReleaseAge waivers for js-yaml and mermaid were temporary and have both aged past the 7-day window; leaving them behind would disable the supply-chain gate for those packages indefinitely.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
PR SummaryLow Risk Overview Because sim-cli builds with Reviewed by Cursor Bugbot for commit 39f708e. Configure here. |
Greptile SummaryThis PR updates the sim CLI’s bundled
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| packages/sim-cli/package.json | Updates the exact js-yaml development dependency to the compatible security-patched 4.3.1 release. |
| bun.lock | Aligns sim-cli with the existing integrity-pinned js-yaml 4.3.1 resolution and removes its obsolete 4.3.0 entry. |
Reviews (2): Last reviewed commit: "Merge remote-tracking branch 'origin/sta..." | Re-trigger Greptile
…m-cli # Conflicts: # bunfig.toml
|
@cursor review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 39f708e. Configure here.
Summary
js-yamlfrom 4.3.0 to 4.3.1 inpackages/sim-cli, closing Dependabot alert feat(marketplace): adding marketplace workflow to registry #219 (GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 — quadratic CPU consumption in!!omapresolution, never backported to the 4.3.0 line).--packages=bundle, sojs-yamlis bundled into the publishedsimCLI. Onlydumpis called at runtime (loadappears only in tests), so there's no known exploit path — the vulnerable parser was just being shipped.apps/simpins, so the lockfile just drops sim-cli's separate 4.3.0 resolution and falls back to the hoisted copy. No other package moves.This originally also dropped the aged-out
js-yaml/mermaidentries fromminimumReleaseAgeExcludes, but #6777 landed that same cleanup on staging first, so after merging staging the net diff here is only the version bump.Note: transitive
js-yaml4.2.0/4.3.0 copies remain underfumadocs-*,electron-builder, andjson-schema-to-typescript. Those are build-time only and weren't flagged; leaving them to their upstreams rather than forcing a global override that would reach into the electron build untested.Supersedes #6781, which made the same version bump but targeted
main.Type of Change
Testing
packages/sim-cli: 242 tests pass,type-checkclean,bun run buildbundles cleanly against 4.3.1bun run lint,check-block-registry.ts origin/staging, andbun run check:audits(29 audits) all passChecklist