From 9b1b07394d13dc374d94fc041d3d80cad904e76b Mon Sep 17 00:00:00 2001 From: Waleed Latif Date: Mon, 17 Aug 2026 14:02:59 -0700 Subject: [PATCH] chore(deps): bump js-yaml to 4.3.1 in sim-cli and drop the aged-out release-age waivers js-yaml < 4.3.1 has quadratic CPU consumption in !!omap resolution (GHSA-5p4m-2wfm-xmqj / CVE-2026-59870). sim-cli builds with --packages=bundle, so its dev-scoped js-yaml is bundled into the published CLI. 4.3.1 is already what apps/sim pins, so this collapses sim-cli onto the hoisted copy. The minimumReleaseAge waivers for js-yaml and mermaid were temporary and have both aged past the 7-day window; leaving them behind would disable the supply-chain gate for those packages indefinitely. --- bun.lock | 4 +--- bunfig.toml | 18 +++++++----------- packages/sim-cli/package.json | 2 +- 3 files changed, 9 insertions(+), 15 deletions(-) diff --git a/bun.lock b/bun.lock index 1d4fdd0c45c..90823358db5 100644 --- a/bun.lock +++ b/bun.lock @@ -601,7 +601,7 @@ "@xterm/headless": "6.0.0", "chalk": "5.6.2", "commander": "^11.1.0", - "js-yaml": "4.3.0", + "js-yaml": "4.3.1", "typescript": "^7.0.2", "vitest": "^4.1.0", }, @@ -5294,8 +5294,6 @@ "serialize-error/type-fest": ["type-fest@0.13.1", "", {}, "sha512-34R7HTnG0XIJcBSn5XhDd7nNFPRcXYRZrBB2O2jdKqYODldSzBAqzsWoZYYvduky73toYS/ESqxPvkDf/F0XMg=="], - "sim/js-yaml": ["js-yaml@4.3.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q=="], - "slice-ansi/ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="], "slice-ansi/is-fullwidth-code-point": ["is-fullwidth-code-point@4.0.0", "", {}, "sha512-O4L094N2/dZ7xqVdrXhh9r1KODPJpFms8B5sGdJLPy664AgvXsreZUyCQQNItZRDlYug4xStLjNp/sz3HvBowQ=="], diff --git a/bunfig.toml b/bunfig.toml index 1c62a63c2cf..a99d07f9c1f 100644 --- a/bunfig.toml +++ b/bunfig.toml @@ -4,17 +4,13 @@ exact = true # (blocks freshly published, potentially compromised releases). minimumReleaseAge = 604800 # @typescript/native-preview stays excluded permanently: it only publishes nightly -# dev builds, so every version is structurally younger than any age gate. -# mermaid 11.16.1 (published 2026-08-04) clears five open Dependabot advisories that -# 11.15.0 carries: architecture-diagram and config-API prototype pollution, radar and -# XY-chart DoS, and CSS injection into siblings of the diagram. It is inside the 7-day -# window and cannot be installed without an exception; it ages out on 2026-08-11 — drop -# the entry then, and re-date this note on any further bump rather than deleting the entry -# early, because removing it while the pinned version is still inside the window blocks the -# bump outright. js-yaml 4.3.1 (published 2026-07-31) carries the CVE-2026-59870 !!omap -# quadratic-CPU fix, which was never backported to the 4.3.0 line; it ages out on 2026-08-07, -# so that entry can go on the next touch of this file. -minimumReleaseAgeExcludes = ["@typescript/native-preview", "mermaid", "js-yaml"] +# dev builds, so every version is structurally younger than any age gate. Every other +# entry here is a temporary waiver for one pinned version that is still inside the +# window, and must be dropped once that version ages out — an exclusion left behind +# disables the gate for that package forever. Both prior waivers have aged out: +# mermaid 11.16.1 (published 2026-08-04) on 2026-08-11, and js-yaml 4.3.1 +# (published 2026-07-31) on 2026-08-07. +minimumReleaseAgeExcludes = ["@typescript/native-preview"] [run] env = { NEXT_PUBLIC_APP_URL = "http://localhost:3000" } diff --git a/packages/sim-cli/package.json b/packages/sim-cli/package.json index 432ee0f3fb3..856473edcee 100644 --- a/packages/sim-cli/package.json +++ b/packages/sim-cli/package.json @@ -53,7 +53,7 @@ "@xterm/headless": "6.0.0", "chalk": "5.6.2", "commander": "^11.1.0", - "js-yaml": "4.3.0", + "js-yaml": "4.3.1", "typescript": "^7.0.2", "vitest": "^4.1.0" }