Skip to content

chore(deps): bump js-yaml to 4.3.1 in sim-cli and drop the aged-out release-age waivers - #6784

Merged
waleedlatif1 merged 2 commits into
stagingfrom
fix/js-yaml-cve-sim-cli
Aug 17, 2026
Merged

chore(deps): bump js-yaml to 4.3.1 in sim-cli and drop the aged-out release-age waivers#6784
waleedlatif1 merged 2 commits into
stagingfrom
fix/js-yaml-cve-sim-cli

Conversation

@waleedlatif1

@waleedlatif1 waleedlatif1 commented Aug 17, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Bumps js-yaml from 4.3.0 to 4.3.1 in packages/sim-cli, closing Dependabot alert feat(marketplace): adding marketplace workflow to registry #219 (GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 — quadratic CPU consumption in !!omap resolution, never backported to the 4.3.0 line).
  • Dependabot classes this dev-scope, but sim-cli builds with --packages=bundle, so js-yaml is bundled into the published sim CLI. Only dump is called at runtime (load appears only in tests), so there's no known exploit path — the vulnerable parser was just being shipped.
  • 4.3.1 is already what apps/sim pins, so the lockfile just drops sim-cli's separate 4.3.0 resolution and falls back to the hoisted copy. No other package moves.

This originally also dropped the aged-out js-yaml/mermaid entries from minimumReleaseAgeExcludes, but #6777 landed that same cleanup on staging first, so after merging staging the net diff here is only the version bump.

Note: transitive js-yaml 4.2.0/4.3.0 copies remain under fumadocs-*, electron-builder, and json-schema-to-typescript. Those are build-time only and weren't flagged; leaving them to their upstreams rather than forcing a global override that would reach into the electron build untested.

Supersedes #6781, which made the same version bump but targeted main.

Type of Change

  • Chore / dependency update

Testing

  • packages/sim-cli: 242 tests pass, type-check clean, bun run build bundles cleanly against 4.3.1
  • Lockfile is stable — regenerating after the staging merge produces no drift
  • bun run lint, check-block-registry.ts origin/staging, and bun run check:audits (29 audits) all pass

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

…elease-age waivers

js-yaml < 4.3.1 has quadratic CPU consumption in !!omap resolution
(GHSA-5p4m-2wfm-xmqj / CVE-2026-59870). sim-cli builds with
--packages=bundle, so its dev-scoped js-yaml is bundled into the
published CLI. 4.3.1 is already what apps/sim pins, so this collapses
sim-cli onto the hoisted copy.

The minimumReleaseAge waivers for js-yaml and mermaid were temporary
and have both aged past the 7-day window; leaving them behind would
disable the supply-chain gate for those packages indefinitely.
@waleedlatif1
waleedlatif1 requested a review from a team as a code owner August 17, 2026 21:03
@vercel

vercel Bot commented Aug 17, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
docs Ready Ready Preview Aug 17, 2026 9:18pm

Request Review

@cursor

cursor Bot commented Aug 17, 2026

Copy link
Copy Markdown

PR Summary

Low Risk
Patch-level dependency bump with no application logic changes; aligns sim-cli with an already-pinned 4.3.1 elsewhere in the monorepo.

Overview
Bumps js-yaml from 4.3.0 to 4.3.1 in packages/sim-cli and updates bun.lock, addressing Dependabot/GHSA-5p4m-2wfm-xmqj (quadratic CPU in !!omap parsing on the unmaintained 4.3.0 line).

Because sim-cli builds with --packages=bundle, that dependency is shipped in the published sim binary; production output formatting uses dump only (load is test-only), so this is mainly about not bundling a flagged parser version. The lockfile drops sim-cli’s separate 4.3.0 resolution and aligns with the hoisted 4.3.1 already used elsewhere (e.g. apps/sim).

Reviewed by Cursor Bugbot for commit 39f708e. Configure here.

@greptile-apps

greptile-apps Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

This PR updates the sim CLI’s bundled js-yaml dependency from 4.3.0 to 4.3.1 and removes its redundant package-specific lockfile resolution.

  • Pins js-yaml 4.3.1 in the sim CLI manifest.
  • Reuses the existing hoisted 4.3.1 lockfile entry instead of retaining a separate 4.3.0 copy.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename Overview
packages/sim-cli/package.json Updates the exact js-yaml development dependency to the compatible security-patched 4.3.1 release.
bun.lock Aligns sim-cli with the existing integrity-pinned js-yaml 4.3.1 resolution and removes its obsolete 4.3.0 entry.

Reviews (2): Last reviewed commit: "Merge remote-tracking branch 'origin/sta..." | Re-trigger Greptile

@waleedlatif1

Copy link
Copy Markdown
Collaborator Author

@greptile

@waleedlatif1

Copy link
Copy Markdown
Collaborator Author

@cursor review

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit 39f708e. Configure here.

@waleedlatif1
waleedlatif1 merged commit d152fad into staging Aug 17, 2026
27 of 28 checks passed
@waleedlatif1
waleedlatif1 deleted the fix/js-yaml-cve-sim-cli branch August 17, 2026 21:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant