[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12},"actionData","errors","root",{"_484":-7,"_485":-5,"_486":-5,"_487":-5,"_488":14,"_489":40,"_490":491,"_492":493,"_494":14,"_495":496,"_497":498,"_37":38,"_39":40},"routes/_auth",{"_465":-5,"_466":467,"_468":469,"_470":471,"_128":14,"_33":14,"_472":14,"_473":14,"_474":14,"_475":14,"_476":-7,"_477":478,"_479":480,"_481":482,"_483":14,"_37":38,"_39":40},"routes/_auth.cipes.$cipeId",{"_20":101,"_102":14,"_103":-5,"_18":104,"_105":106,"_107":-5,"_108":109,"_110":14,"_111":40,"_112":14,"_15":-5,"_113":114,"_115":14,"_116":117,"_118":-7,"_22":14,"_119":14,"_120":40,"_121":122,"_123":124,"_125":122,"_126":127,"_128":14,"_129":14,"_130":14,"_131":40,"_132":40,"_133":134,"_135":136,"_137":14,"_138":-5,"_37":38,"_39":40,"_139":140},"routes/_auth.cipes.$cipeId.self-healing",{"_13":14,"_15":-5,"_16":-5,"_17":-5,"_18":19,"_20":21,"_22":14,"_23":14,"_24":-5,"_25":-5,"_26":-5,"_27":-5,"_28":29,"_30":14,"_31":14,"_32":-5,"_33":14,"_34":14,"_35":-5,"_36":14,"_37":38,"_39":40},"hasRightToTakeAction",false,"aiFix","triggeredCipeId","existingFeedback","ciPipelineExecution",{"_41":47,"_48":49,"_50":51,"_52":53,"_54":-5},"workspace",{"_41":42,"_43":44,"_45":46},"multipleFailuresWithoutFixes","showLogsButton","isFork","isDraft","actionByInfo","autoApplySuggestion","userDismissedTaskTypes",[],"autoApplyAlreadyEnabled","canEnableAutoApply","claudeStatus","isSystemAdmin","hasSuggestedFixFailureReasonDetails","firstAiFixAgentStepUrl","throttleAlreadyDismissed","result","success","ok",true,"_id","63e6951e043da20dd8321aec","orgId","63e68e668b89af000d2644c4","name","@o3r/framework","6acf5709b04c861ab9093790","branch","gh-readonly-queue/main/pr-4514-31da3deaf8c0a53b92eec04e344bc6faa0a4bae9","vcsContext",{"_48":49,"_78":49,"_79":80,"_81":82,"_83":-5,"_84":-5,"_85":86,"_87":88,"_89":90,"_91":92,"_93":94,"_95":96,"_97":98,"_99":100,"_24":-5,"_25":-5},"selfHealing",{"_55":56,"_57":58,"_59":14},"selfHealingSkipInfo","cliOverrides",{"_76":-5,"_77":-5},"workspaceConfigSnapshot",{"_60":40,"_61":40,"_62":40,"_63":14,"_64":40,"_65":66,"_67":-5,"_68":-5,"_69":70,"_71":72,"_73":74,"_75":-5},"isLongLivedBranch","enabled","commentNotificationEnabled","allowAnonymousExternalCommand","enableFlakyRerunsAutomatically","allowDraftPullRequests","protectedBranchPatterns",[],"selfHealingCISetupCompletedAt","fixPatterns","neverFixPatterns",[],"autoApplyIncludePatterns",[],"autoApplyExcludePatterns",[],"formatCommand","fixTasks","autoApplyFixes","ref","title","chore(deps): update dependency js-yaml to v5.4.1 [security] (main) (#4514)\n\nThis PR contains the following updates:\n\n| Package | Change |\n[Age](https://docs.renovatebot.com/merge-confidence/) |\n[Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [js-yaml](https://redirect.github.com/nodeca/js-yaml) | [`5.2.2` →\n`5.4.1`](https://renovatebot.com/diffs/npm/js-yaml/5.2.2/5.4.1) |\n![age](https://developer.mend.io/api/mc/badges/age/npm/js-yaml/5.4.1?slim=true)\n|\n![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/js-yaml/5.2.2/5.4.1?slim=true)\n|\n\n---\n\n### JS-YAML: Quadratic-complexity DoS in merge key handling via repeated\naliases\n[CVE-2026-53550](https://nvd.nist.gov/vuln/detail/CVE-2026-53550) /\n[GHSA-h67p-54hq-rp68](https://redirect.github.com/advisories/GHSA-h67p-54hq-rp68)\n\n

More information

\n\n#### Details\n##### Summary\nA crafted YAML document can trigger algorithmic CPU exhaustion in\n`js-yaml` merge-key processing (`<<`) by repeating the same alias many\ntimes in a merge sequence.\nThis causes quadratic parse-time behavior relative to input size and can\nblock a Node.js worker/event loop for seconds with a relatively small\npayload (tens of KB), resulting in denial of service.\n\n##### Details\nThe issue is in merge handling inside `lib/loader.js`:\n\n- `storeMappingPair(...)` iterates every element of a merge sequence\nwhen key tag is `tag:yaml.org,2002:merge`.\n- For each element, it calls `mergeMappings(...)`.\n- `mergeMappings(...)` computes `Object.keys(source)` and performs\n`_hasOwnProperty.call(destination, key)` checks for each key.\n\nWhen input is of the form:\n\na: &a {k0:0, k1:0, ..., kK:0}\nb: {<<: [*a, *a, *a, ... repeated M times ...]}\nall *a entries refer to the same anchored object. After the first merge,\nsubsequent merges are semantically no-ops, but the parser still\nreprocesses all keys each time.\nResulting work is O(K * M), while input size is O(K + M), giving\nquadratic scaling as payload grows.\nRelevant code path:\nlib/loader.js in storeMappingPair(...) merge branch (keyTag ===\n'tag:yaml.org,2002:merge')\nlib/loader.js mergeMappings(...)\n\n##### Root cause\nFile: lib/loader.js\nFunction: storeMappingPair(state, _result, overridableKeys, keyTag,\nkeyNode,\nvalueNode, startLine, startLineStart, startPos)\nLines: ~359-366\n\n if (keyTag === 'tag:yaml.org,2002:merge') {\n if (Array.isArray(valueNode)) {\nfor (index = 0, quantity = valueNode.length; index < quantity; index +=\n1) {\nmergeMappings(state, _result, valueNode[index], overridableKeys);\n }\n } else {\n mergeMappings(state, _result, valueNode, overridableKeys);\n }\n }\n\nWhen the merge value is a sequence (YAML 1.1 <<: [ *a, *a, ... ]), each\nelement\nis handed to mergeMappings() without deduplication. mergeMappings() then\ndoes\n\n sourceKeys = Object.keys(source);\n for (index = 0; index < sourceKeys.length; index += 1) {\n key = sourceKeys[index];\n if (!_hasOwnProperty.call(destination, key)) {\n setProperty(destination, key, source[key]);\n overridableKeys[key] = true;\n }\n }\n\nEvery alias reference in the sequence resolves (by design) to the SAME\nobject\nvia state.anchorMap. After the first merge, every subsequent merge of\nthat same\nreference is a pure no-op semantically, but still performs:\n\n * one Object.keys(source) call (O(K))\n * K _hasOwnProperty.call checks on the destination\n\nTotal: M * K hasOwnProperty checks + M Object.keys allocations, while\nthe final\nobject and all observable side effects are identical to a single merge.\n\nYAML semantics for `<<:` are idempotent and commutative over duplicate\nsources,\nso collapsing duplicates preserves behavior exactly; this isn't a spec\ntrade-off.\n\n##### PoC\nEnvironment:\njs-yaml version: 4.1.1\nNode.js: v24.5.0\nPlatform: arm64 macOS (reproduced consistently)\nReproduction script:\nCreate many keys in one anchored map (&a).\nMerge that same alias repeatedly via <<: [*a, *a, ...].\nMeasure parse time and compare with control payload using single merge\n(<<: *a).\nObserved repeated runs (same machine):\nK=M=1000, input 9,909 bytes: ~33–36 ms\nK=M=2000, input 20,909 bytes: ~121–123 ms\nK=M=4000, input 42,909 bytes: ~524–537 ms\nK=M=6000, input 64,909 bytes: ~1,608–1,829 ms\nK=M=8000, input 86,909 bytes: ~3,395–3,565 ms\nControl (single merge, similar key counts):\nK=2000: ~1–2 ms\nK=4000: ~3 ms\nK=8000: ~5 ms\nAlso verified: repeated-merge output equals single-merge output (same\nkey count and same JSON), confirming excess time is redundant\ncomputation.\n\n##### Impact\nThis is a denial-of-service vulnerability (CPU exhaustion / algorithmic\ncomplexity).\nAny service parsing untrusted YAML with js-yaml can be impacted,\nincluding API backends, CI tools, config processors, and automation\nservices. An attacker can submit crafted YAML to significantly increase\nCPU time and reduce availability.\n\n##### Suggested fix:\nDedupe the merge source list by reference before invoking mergeMappings.\nAny of\nthe following are minimal and preserve YAML 1.1 merge semantics:\n\ndedupe in storeMappingPair:\n\n if (keyTag === 'tag:yaml.org,2002:merge') {\n if (Array.isArray(valueNode)) {\n var seen = new Set();\nfor (index = 0, quantity = valueNode.length; index < quantity; index +=\n1) {\n var src = valueNode[index];\nif (seen.has(src)) continue; // idempotent; skip redundant alias\n seen.add(src);\n mergeMappings(state, _result, src, overridableKeys);\n }\n } else {\n mergeMappings(state, _result, valueNode, overridableKeys);\n }\n }\n\n#### Severity\n- CVSS Score: 5.3 / 10 (Medium)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`\n\n#### References\n-\n[https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68](https://redirect.github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68)\n-\n[https://nvd.nist.gov/vuln/detail/CVE-2026-53550](https://nvd.nist.gov/vuln/detail/CVE-2026-53550)\n-\n[https://github.com/advisories/GHSA-h67p-54hq-rp68](https://redirect.github.com/advisories/GHSA-h67p-54hq-rp68)\n\nThis data is provided by the [GitHub Advisory\nDatabase](https://redirect.github.com/advisories/GHSA-h67p-54hq-rp68)\n([CC-BY\n4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n

\n\n---\n\n### js-yaml: YAML merge-key chains can force quadratic CPU consumption\n[CVE-2026-59869](https://nvd.nist.gov/vuln/detail/CVE-2026-59869) /\n[GHSA-52cp-r559-cp3m](https://redirect.github.com/advisories/GHSA-52cp-r559-cp3m)\n\n

More information

\n\n#### Details\n##### Impact\n\njs-yaml can spend quadratic CPU time parsing a document whose size grows\nonly linearly. The issue is triggered by a chain of mappings where each\nmapping merges the previous one:\n\n```yaml\na0: &a0 { k0: 0 }\na1: &a1 { <<: *a0, k1: 1 }\na2: &a2 { <<: *a1, k2: 2 }\na3: &a3 { <<: *a2, k3: 3 }\n...\nb: *aN\n```\n\nFor each new mapping, the loader has to enumerate the keys inherited\nfrom the previous mapping. With N chained mappings, this results in\nroughly 1 + 2 + ... + N merged-key visits, i.e., O(N^2) work for O(N)\ninput size.\n\n##### PoC\n\nFrom N = 4000 delay become > 1s (doc size < 100K)\n\n```js\nimport { performance } from 'node:perf_hooks'\nimport { Buffer } from 'node:buffer'\nimport { load, YAML11_SCHEMA } from 'js-yaml'\n\nconst n = Number(process.argv[2] || 4000)\n\nfunction makeMergeChain (count) {\n const lines = ['a0: &a0 { k0: 0 }']\n\n for (let i = 1; i < count; i++) {\n lines.push(`a${i}: &a${i} { <<: *a${i - 1}, k${i}: ${i} }`)\n }\n\n lines.push(`b: *a${count - 1}`)\n return `${lines.join('\\n')}\\n`\n}\n\nconst source = makeMergeChain(n)\n\nconsole.log(source.split('\\n').slice(0, 8).join('\\n'))\nconsole.log('...')\nconsole.log(source.split('\\n').slice(-4).join('\\n'))\nconsole.log()\nconsole.log(`N: ${n}`)\nconsole.log(`YAML size: ${Buffer.byteLength(source)} bytes`)\n\nconst started = performance.now()\nconst result = load(source, { schema: YAML11_SCHEMA })\nconst elapsed = performance.now() - started\n\nconsole.log(`parse time: ${elapsed.toFixed(1)} ms`)\nconsole.log(`top-level keys: ${Object.keys(result).length}`)\nconsole.log(`b keys: ${Object.keys(result.b).length}`)\n```\n\n##### Patches\n\nFix released. The most robust protection is to limit the total number of\nmerged keys per parse call. This should close all past and future edge\ncases with merge. The default 10K-key limit should be okay in most\ncases.\n\n#### Severity\n- CVSS Score: 7.5 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n#### References\n-\n[https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m](https://redirect.github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m)\n-\n[https://nvd.nist.gov/vuln/detail/CVE-2026-59869](https://nvd.nist.gov/vuln/detail/CVE-2026-59869)\n-\n[https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7](https://redirect.github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7)\n-\n[https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4](https://redirect.github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4)\n-\n[https://github.com/nodeca/js-yaml/releases/tag/3.15.0](https://redirect.github.com/nodeca/js-yaml/releases/tag/3.15.0)\n-\n[https://github.com/nodeca/js-yaml/releases/tag/4.3.0](https://redirect.github.com/nodeca/js-yaml/releases/tag/4.3.0)\n-\n[https://github.com/advisories/GHSA-52cp-r559-cp3m](https://redirect.github.com/advisories/GHSA-52cp-r559-cp3m)\n\nThis data is provided by the [GitHub Advisory\nDatabase](https://redirect.github.com/advisories/GHSA-52cp-r559-cp3m)\n([CC-BY\n4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n

\n\n---\n\n### JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and\n4.x) — CVE-2026-59870 fix not backported\n\n[GHSA-5p4m-2wfm-xmqj](https://redirect.github.com/advisories/GHSA-5p4m-2wfm-xmqj)\n\n

More information

\n\n#### Details\n##### Quadratic CPU consumption in `!!omap` resolution (js-yaml 3.x and\n4.x)\n\n##### Summary\n\n`resolveYamlOmap()` enforces key uniqueness for `!!omap` sequences with\na linear\nscan (`objectKeys.indexOf(...)`) inside the per-element loop, making\nresolution\n**O(n²)** in the number of entries. A modestly sized YAML document\ntherefore\nconsumes disproportionate CPU inside `yaml.load()`, giving a denial of\nservice\nagainst any consumer that parses untrusted YAML.\n\n`!!omap` is registered in the **default schema**\n(`lib/schema/default.js` → `require('../type/omap')`), so a plain\n`yaml.load(untrustedInput)` with no options is affected — no custom\nschema or\nnon-default configuration is required.\n\n**This is the same weakness as CVE-2026-59870 / GHSA-724g-mxrg-4qvm**,\nwhich was\nfixed in the 5.x line in 5.2.1. That fix was never backported: both\ncurrently\nmaintained legacy lines still carry the original implementation.\n\n##### Affected versions\n\n| Line | Latest tested | Status |\n|---|---|---|\n| 3.x | **3.15.0** | Affected — `objectKeys.indexOf(pairKey)` at\n`lib/type/omap.js:29` |\n| 4.x | **4.3.0** | Affected — `objectKeys.indexOf(pairKey)` at\n`lib/type/omap.js:30` |\n| 5.x | 5.2.2 | **Not affected** — fixed in 5.2.1 (uses a `Set`) |\n\nBoth figures are the newest release of each line at the time of writing,\nso\nthis is not a \"you are on an old version\" issue.\n\n##### Details\n\n`lib/type/omap.js` (js-yaml 4.3.0):\n\n```js\nif (objectKeys.indexOf(pairKey) === -1) objectKeys.push(pairKey)\nelse return false\n```\n\n`objectKeys` grows by one element per entry, and\n`Array.prototype.indexOf` is a\nlinear scan, so resolving an `n`-entry `!!omap` performs roughly\n`1 + 2 + … + n` comparisons — quadratic in `n`. The work happens\nsynchronously\ninside `yaml.load()`, blocking the event loop for its whole duration.\n\nThe 5.x line already solves exactly this by tracking seen keys in a\n`Set`\n(`src/tag/sequence/omap.ts`):\n\n```ts\nif (carrier.seen.has(key)) return 'duplicate key in ordered map'\ncarrier.seen.add(key)\n```\n\n##### Proof of concept\n\n```js\n// poc.js — node poc.js\nconst yaml = require('js-yaml');\nconst doc = n => '!!omap\\n' + Array.from({length: n}, (_, i) => `- k${i}: ${i}`).join('\\n') + '\\n';\n\nfor (const n of [10000, 20000, 40000, 80000]) {\n const d = doc(n), t = Date.now();\n yaml.load(d); // default schema, no options\n console.log(`n=${n} bytes=${d.length} load=${Date.now() - t}ms`);\n}\n```\n\n##### Measured (node v20.20.2, default heap, no flags)\n\n**js-yaml 4.3.0**\n\n```\nn=10000 bytes=137787 load=54ms\nn=20000 bytes=297787 load=169ms\nn=40000 bytes=617787 load=646ms\nn=80000 bytes=1257787 load=2607ms\n```\n\n**js-yaml 3.15.0**\n\n```\nn=10000 bytes=137787 load=53ms\nn=20000 bytes=297787 load=166ms\nn=40000 bytes=617787 load=641ms\nn=80000 bytes=1257787 load=2567ms\n```\n\nRuntime grows by a factor of ~4 for each doubling of `n`, which is the\nsignature of O(n²) (linear growth would be ~2×).\n\nScaling further: a **2.48 MB** document with 150,000 entries blocked\n`yaml.load()` for **10.8 seconds**.\n\n##### Impact\n\nAny service that parses attacker-influenced YAML with js-yaml 3.x or 4.x\ncan be\nstalled with a small input. Because the loop is synchronous, a single\nrequest\nblocks the Node.js event loop and stalls every other request in the\nprocess —\nso the amplification is per-process, not just per-request.\n\nSuggested severity: consistent with **CVE-2026-59870** (the same\nweakness in\n5.x), i.e. Availability-only impact, network attack vector, no\nprivileges or\nuser interaction required.\n\n##### Suggested fix\n\nMirror the 5.x fix — replace the linear scan with a `Set`:\n\n```js\n// lib/type/omap.js\nconst seen = new Set()\n// ...\nif (seen.has(pairKey)) return false\nseen.add(pairKey)\n```\n\nThis preserves the existing duplicate-key rejection semantics exactly\nwhile\nmaking resolution O(n). A `maxOmapLength`-style cap would also work, but\nthe\n`Set` matches what 5.x already ships and requires no new option.\n\n##### References\n\n- CVE-2026-59870 / GHSA-724g-mxrg-4qvm — same weakness in 5.0.0–5.2.0,\nfixed in 5.2.1\n- `lib/type/omap.js` (3.x, 4.x) — the affected resolver\n- `lib/schema/default.js` — registers `!!omap` in the default schema\n\n##### Discovery\n\nFound by an automated static-analysis and executed-proof-of-concept\nscanner run\nagainst js-yaml 4.2.0, then manually verified against 3.15.0 and 4.3.0\nby\nexecuting the proof of concept above. All timings in this report were\nmeasured\non the **current** releases of each line, not on the version originally\nscanned.\n\n#### Severity\n- CVSS Score: 7.5 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n#### References\n-\n[https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj](https://redirect.github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n-\n[https://github.com/advisories/GHSA-5p4m-2wfm-xmqj](https://redirect.github.com/advisories/GHSA-5p4m-2wfm-xmqj)\n\nThis data is provided by the [GitHub Advisory\nDatabase](https://redirect.github.com/advisories/GHSA-5p4m-2wfm-xmqj)\n([CC-BY\n4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n

\n\n---\n\n### js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge\nsources\n[CVE-2026-84375](https://nvd.nist.gov/vuln/detail/CVE-2026-84375) /\n[GHSA-2883-xcg3-v3hh](https://redirect.github.com/advisories/GHSA-2883-xcg3-v3hh)\n\n

More information

\n\n#### Details\n##### Summary\n\n`maxTotalMergeKeys` does not count empty mappings. An attacker can\nrepeatedly merge a large sequence of them and consume significant CPU\nwithout reaching the configured limit.\n\n##### Example\n\n```yaml\narr: &arr [{}, {}, {}, ...] # N empty mappings\ntargets:\n - <<: *arr # repeated K times\n```\n\nFor every target, the loader iterates all `N` elements of `arr`. This\nresults in `O(N * K)` work while `totalMergeKeys` remains unchanged.\n\n##### PoC\n\n```js\nimport { performance } from 'node:perf_hooks'\nimport { load, YAML11_SCHEMA } from 'js-yaml'\n\nconst n = 20000\n\nconst src =\n 'arr: &arr [' + '{},'.repeat(n).slice(0, -1) + ']\\n' +\n 'targets:\\n' +\n ' - <<: *arr\\n'.repeat(n)\n\nconst started = performance.now()\n\nload(src, { schema: YAML11_SCHEMA })\n\nconsole.log(`${(performance.now() - started).toFixed(1)} ms`)\n```\n\nObserved results:\n\n| N | YAML size | Time |\n|---:|---:|---:|\n| 800 | ~13 KB | ~20 ms |\n| 3200 | ~50 KB | ~180 ms |\n| 20000 | ~500 KB | ~13 s |\n\n##### Impact\n\nAn attacker can submit a relatively small YAML document that causes\nprolonged CPU consumption despite the default `maxTotalMergeKeys` limit.\n\n##### Fix\n\nCount each merge-source mapping as one budget unit, in addition to\ncounting its keys.\n\n##### Difference with v5\n\nIn v3 & v4, merge is enabled by default. So, the severity score is\nhigher.\n\n#### Severity\n- CVSS Score: 7.5 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n#### References\n-\n[https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh](https://redirect.github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n-\n[https://nvd.nist.gov/vuln/detail/CVE-2026-84375](https://nvd.nist.gov/vuln/detail/CVE-2026-84375)\n-\n[https://github.com/nodeca/js-yaml/pull/797](https://redirect.github.com/nodeca/js-yaml/pull/797)\n-\n[https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639](https://redirect.github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n-\n[https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480](https://redirect.github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n-\n[https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b](https://redirect.github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n-\n[https://github.com/nodeca/js-yaml/releases/tag/3.15.2](https://redirect.github.com/nodeca/js-yaml/releases/tag/3.15.2)\n-\n[https://github.com/nodeca/js-yaml/releases/tag/4.3.2](https://redirect.github.com/nodeca/js-yaml/releases/tag/4.3.2)\n-\n[https://github.com/advisories/GHSA-2883-xcg3-v3hh](https://redirect.github.com/advisories/GHSA-2883-xcg3-v3hh)\n\nThis data is provided by the [GitHub Advisory\nDatabase](https://redirect.github.com/advisories/GHSA-2883-xcg3-v3hh)\n([CC-BY\n4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n

\n\n---\n\n### js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge\nsources\n\n[GHSA-r3ph-w7gj-g6xm](https://redirect.github.com/advisories/GHSA-r3ph-w7gj-g6xm)\n\n

More information

\n\n#### Details\n##### Summary\n\n`maxTotalMergeKeys` does not count empty mappings. An attacker can\nrepeatedly merge a large sequence of them and consume significant CPU\nwithout reaching the configured limit.\n\n##### Example\n\n```yaml\narr: &arr [{}, {}, {}, ...] # N empty mappings\ntargets:\n - <<: *arr # repeated K times\n```\n\nFor every target, the loader iterates all `N` elements of `arr`. This\nresults in `O(N * K)` work while `totalMergeKeys` remains unchanged.\n\n##### PoC\n\n```js\nimport { performance } from 'node:perf_hooks'\nimport { load, YAML11_SCHEMA } from 'js-yaml'\n\nconst n = 20000\n\nconst src =\n 'arr: &arr [' + '{},'.repeat(n).slice(0, -1) + ']\\n' +\n 'targets:\\n' +\n ' - <<: *arr\\n'.repeat(n)\n\nconst started = performance.now()\n\nload(src, { schema: YAML11_SCHEMA })\n\nconsole.log(`${(performance.now() - started).toFixed(1)} ms`)\n```\n\nObserved results:\n\n| N | YAML size | Time |\n|---:|---:|---:|\n| 800 | ~13 KB | ~20 ms |\n| 3200 | ~50 KB | ~180 ms |\n| 20000 | ~500 KB | ~13 s |\n\n##### Impact\n\nWhen merge keys are enabled, an attacker can submit a relatively small\nYAML document that causes prolonged CPU consumption despite the default\n`maxTotalMergeKeys` limit.\n\n##### Fix\n\nCount every merge source mapping as one budget unit in addition to\ncounting its keys.\n\n#### Severity\n- CVSS Score: 5.3 / 10 (Medium)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`\n\n#### References\n-\n[https://github.com/nodeca/js-yaml/security/advisories/GHSA-r3ph-w7gj-g6xm](https://redirect.github.com/nodeca/js-yaml/security/advisories/GHSA-r3ph-w7gj-g6xm)\n-\n[https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480](https://redirect.github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n-\n[https://github.com/nodeca/js-yaml/releases/tag/5.4.1](https://redirect.github.com/nodeca/js-yaml/releases/tag/5.4.1)\n-\n[https://github.com/advisories/GHSA-r3ph-w7gj-g6xm](https://redirect.github.com/advisories/GHSA-r3ph-w7gj-g6xm)\n\nThis data is provided by the [GitHub Advisory\nDatabase](https://redirect.github.com/advisories/GHSA-r3ph-w7gj-g6xm)\n([CC-BY\n4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n

\n\n---\n\n### Release Notes\n\n

nodeca/js-yaml (js-yaml)

\n\n###\n[`v5.4.1`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#541---2026-08-26)\n\n[Compare\nSource](https://redirect.github.com/nodeca/js-yaml/compare/5.4.0...5.4.1)\n\n##### Changed\n\n- Hard-limit merge sequence size to 100.\n\n##### Security\n\n- Count empty mappings in merge sequences toward `maxTotalMergeKeys` to\nlimit\nCPU usage,\n[#797](https://redirect.github.com/nodeca/js-yaml/issues/797).\n\n###\n[`v5.4.0`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#540---2026-08-25)\n\n[Compare\nSource](https://redirect.github.com/nodeca/js-yaml/compare/5.3.0...5.4.0)\n\n##### Added\n\n- Added the `scalarStyleRules` dumper option to customize string\nformatting.\n See [Scalar styling](docs/scalar_styling.md) for details.\n\n##### Changed\n\n- \\[breaking] Flattened the low-level AST node style representation.\nScalar\nand collection nodes now use `SCALAR_STYLE` and `COLLECTION_STYLE`\nvalues;\nexplicit tags use the separate `tagged` property. Alias nodes now\ncontain\nonly `kind` and `anchor`. This only affects code that directly\nconstructs or\n edits AST nodes.\n- \\[breaking] The `sortKeys` option was rewritten using AST mutation to\navoid\n side effects.\n- Reworked scalar style selection. This can change formatting without\nchanging\nloaded values; in particular, whitespace-only strings are now\ndouble-quoted.\n\n##### Fixed\n\n- Accept a byte order mark at the start of each document in a stream,\n[#791](https://redirect.github.com/nodeca/js-yaml/issues/791).\n- Produce valid flow mappings with `quoteFlowKeys` and\n`flowSkipColonSpace`,\nincluding alias and property-only keys,\n[#786](https://redirect.github.com/nodeca/js-yaml/issues/786).\n- Preserve empty scalar items when converting block sequences to flow\nstyle.\n- Do not apply the 1024-character simple-key limit to flow mapping keys.\n- Count Unicode code points, rather than UTF-16 code units, for the\n 1024-character simple-key limit.\n- Add an explicit document-end marker after keep-chomped block scalars\nwhen\n needed to preserve trailing newlines.\n\n###\n[`v5.3.0`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#530---2026-08-14)\n\n[Compare\nSource](https://redirect.github.com/nodeca/js-yaml/compare/5.2.3...5.3.0)\n\nThis release focuses on reworking the documentation and making small\narchitectural improvements before moving forward.\n\n##### Added\n\n- Added completely new documentation.\n- Exported `DUMP_SCHEMA`, the default schema used by the dumper.\n- Added `YAMLException.throwAt()` for throwing an error at a source\nposition.\n\n##### Changed\n\n- Changed flat constant exports to grouped exports: `EVENT_ID`,\n`SCALAR_STYLE`,\n`COLLECTION_STYLE`, and `CHOMPING_MODE`, along with their value types.\nThe old\n exports are still preserved, but deprecated.\n- Made `identify` mandatory for custom tag definitions. Use\n `identify: () => false` for load-only tags.\n\n##### Deprecated\n\n- Deprecated flat constant exports. Use grouped ones instead.\n\n##### Removed\n\n- Removed the `MERGE_KEY` export (not used anymore after last fixes).\n\n##### Fixed\n\n- Validate `<<` sequence items at merge time, so aliased merge sources\nare\n checked too.\n- Resolve `<<` outside of a mapping key as the plain string `'<<'`,\nmatching\n v4, instead of leaking an internal symbol into the result.\n\n###\n[`v5.2.3`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#523---2026-08-01)\n\n[Compare\nSource](https://redirect.github.com/nodeca/js-yaml/compare/5.2.2...5.2.3)\n\n##### Fixed\n\n- Prevent prototype fallback when resolving tags and mapping entries,\n[#782](https://redirect.github.com/nodeca/js-yaml/issues/782).\n- Resolve `!!timestamp` years 0000-0099 correctly,\n[#775](https://redirect.github.com/nodeca/js-yaml/issues/775).\n- Preserve implicit null mapping values before document markers and\nreject\nunpaired mapping event streams,\n[#784](https://redirect.github.com/nodeca/js-yaml/issues/784).\n- Preserve folded scalar values with tab-indented lines when\nround-tripping a\nparsed AST through `present()`; `dump()` and loading are unaffected,\n[#780](https://redirect.github.com/nodeca/js-yaml/issues/780).\n\n

\n\n---\n\n### Configuration\n\n📅 **Schedule**: (in timezone Europe/Paris)\n\n- Branch creation\n - At any time (no schedule defined)\n- Automerge\n - At any time (no schedule defined)\n\n🚦 **Automerge**: Enabled.\n\n♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the\nrebase/retry checkbox.\n\n🔕 **Ignore**: Close this PR and you won't be reminded about this update\nagain.\n\n---\n\n- [ ] If you want to rebase/retry this PR, check\nthis box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).\nView the [repository job\nlog](https://developer.mend.io/github/AmadeusITGroup/otter).\n\n","headSha","5031951ced722c8d62effdc5449b1348485f6a40","baseSha","parentShas","commitLink","https://github.com/AmadeusITGroup/otter/commit/5031951ced722c8d62effdc5449b1348485f6a40","author","Florian PAUL","authorEmail","110407799+fpaul-1A@users.noreply.github.com","authorUrl","https://github.com/fpaul-1a","authorAvatarUrl","https://github.com/fpaul-1a.png","repositoryUrl","https://github.com/AmadeusITGroup/otter","platformName","GITHUB_ACTIONS","runnerProvider","GITHUB",{"_41":42,"_43":44,"_149":419,"_45":46,"_60":40,"_420":421,"_422":-5,"_423":-5,"_424":425,"_426":427,"_428":429,"_430":40,"_431":432,"_433":432,"_175":434,"_435":436,"_437":438,"_439":40,"_440":40,"_441":442,"_443":444,"_445":-7,"_446":-7},"isAdmin","membership",{"_41":47,"_312":42,"_313":219,"_48":49,"_149":314,"_151":315,"_222":316,"_317":318,"_50":319,"_224":225,"_320":14,"_321":-5,"_322":323,"_324":325,"_326":327,"_328":329,"_330":-5,"_331":40,"_332":333,"_76":-5,"_77":-5,"_52":334,"_54":-5,"_335":-5,"_336":-5,"_337":-5,"_338":-5,"_339":-5,"_340":-5},"runGroup",{"_217":218,"_105":219,"_149":220,"_151":221,"_222":223,"_224":225,"_226":-5,"_227":40,"_228":-5,"_229":-5,"_230":-5,"_231":232,"_233":40,"_234":235,"_236":14,"_237":238,"_239":240,"_241":242,"_243":-5,"_244":245,"_246":247,"_248":249,"_250":-5,"_251":14,"_252":253,"_254":255},"cancellationTriggeringUserName","organization",{"_45":148,"_149":150,"_151":152,"_145":40,"_153":154,"_60":40,"_155":156,"_157":158,"_159":14,"_160":161,"_162":40,"_163":164,"_165":44,"_41":44,"_166":167,"_168":-7,"_169":14,"_170":14,"_171":14,"_172":14,"_173":14,"_174":-5,"_175":-5,"_176":-5,"_177":14,"_178":-5,"_179":-7},"shouldCompleteAccessControlSetup","isWorkspaceClaimed","isCurrentUserOrganizationMember","mostRecentCipeForBranch",{"_41":147},"supersededOnBranch","attempts",[],"guideMilestoneStatus","isResourceUsageAvailable","isCipeExecutionTimelineEnabled","cappedCiPipelineExecutionCount",10,"currentUsagePercentage",71,"contributorsCount","nxCloudAppUrl","https://cloud.nx.app","isPrivateCloud","isSandboxingToggleEnabled","isUltracacheUiEnabled","isSandboxingPreviewEligible","isResourceUsagePreviewEligible","organizationActor",{"_144":145,"_146":14},"settingsDestinations",[],"managedCiNavigation","pipelinePreview","managedContext",{"_141":142,"_143":-5},"loadedAt",1792069091256,"managed","access","public","isInternalAdmin","6acf57e1804b872e0a4c1755","AmadeusITGroup","createdAt",["D",1676054118998],"updatedAt",["D",1681913345534],"allowedEmailDomains",[216],"plan","OSS","planActivationDate",["D",1686144031537],"isEligibleForProTrial","planLimits",{"_200":201,"_202":203,"_204":205,"_206":207,"_208":207,"_209":210,"_211":212,"_213":212,"_214":215},"isAiEnabled","planTransitions",[],"id","memberships",[180,181,182,183,184,185,186,187],"privateCloudInstallationId","hasBillingInformation","hasLicense","isUnclaimed","isOnTrial","isHighPriority","vcsProfileLink","vcsConfiguration","lastMembersSyncedAt","isAiBringYourOwnKey","enterpriseTrial","disabledReasonMessage",{"_188":199,"_190":191},{"_188":198,"_190":193},{"_188":197,"_190":191},{"_188":196,"_190":193},{"_188":195,"_190":193},{"_188":194,"_190":193},{"_188":192,"_190":193},{"_188":189,"_190":191},"userId","63eb8f0c1147ed000ed89147","role","admin","656f2a38d8c7f6f8d5bfdab5","member","64a51a42097e04000dcff5a3","63f5d0d76abadd000e2a636a","63ee2a741147ed000ed892b0","63ecec5bd91fa9000e2ebaa1","63ecec62d91fa9000e2ebaa3","63e68de49bae37000e41c9c6","baseIncludedCredits",300000,"additionalCredits",{},"discountedCreditsMaximum",0,"contributorLimit",70,"concurrentConnectionLimit","runsLimit",1000000,"adminUserLimit",9999,"workspaceLimit","modifiers",[],"amadeus.com","ciExecutionEnv","","38548607759-1",["D",1791973129279],["D",1791973308115],"completedAt",["D",1791973308115],"status","SUCCEEDED","agentCount","stopAgentsOnFailure","criticalErrorMessage","commandCount","stopAgentsAfter","agents",[],"closed","completedBy","HEARTBEAT","requireExplicitCompletion","linkedWorkflows",[],"activeAgents",[],"assignmentRules",[],"schedulingConstraintsInput","agentsMetadata",{},"agentInstances",{},"stopAgentsAfterConditions",{},"continuousAssignment","resourcePackingEnabled","packingDecisionReason","default","config",{"_256":257,"_217":-5},"sources",{"_258":259,"_260":261,"_262":263,"_264":265},"lifecycle",{"_301":302,"_303":304,"_305":306},"ai",{"_293":294,"_295":296},"dte",{"_273":274,"_275":276,"_241":277,"_278":279},"nxAgents",{"_266":267},"withEnvVars",[268],{"_269":270,"_271":272,"_217":-5},"kind","LEGACY","value",[],"enabledByDefault",[292],"distributeOn",[],[287],"schedulingConstraints",[280],{"_269":281,"_271":282,"_217":-5},"DEFAULT",{"_283":284,"_285":286},"_t","io.nrwl.models.SchedulingConstraintsInput.Inline","constraints",[],{"_269":281,"_271":288,"_217":-5},{"_283":289,"_290":291},"io.nrwl.models.AssignmentRulesInput.Inline","rules",[],{"_269":281,"_271":40,"_217":-5},"fixTasksPatterns",[299],"autoApplyPatterns",[297],{"_269":281,"_271":298,"_217":-5},[],{"_269":281,"_271":300,"_217":-5},[],"failAfter",[310],"heartbeat",[309],"stopAfter",[307],{"_269":270,"_271":308,"_217":-5},[],{"_269":270,"_271":40,"_217":-5},{"_269":270,"_271":311,"_217":-5},1,"workspaceId","ciExecutionId",["D",1791973129279],["D",1791973308178],["D",1791973308115],"runGroups",[416],{"_48":49,"_78":49,"_79":80,"_81":82,"_83":-5,"_84":-5,"_85":86,"_87":88,"_89":90,"_91":92,"_93":94,"_95":96,"_97":98,"_99":100,"_24":-5,"_25":-5},"cancellationRequested","affectedProjectRatio","touchedProjects",[],"affectedProjects",[347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,20,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415],"criticalWorkflowErrors",[],"projectGraphSha","a261da625698ef3b657b383597017f4851381c7da15e6e4e9be12e0525ccde95","fileMapSha","cacheEnabled","hashScope","UNPROTECTED",{"_55":341,"_57":342,"_59":14},"pipelineHeadSha","pipelineParentShas","ioSnapshotCommitGraph","ioSnapshotCommitGraphClaimedAt","managedCi","cancellation",{"_76":-5,"_77":-5},{"_60":40,"_61":40,"_62":40,"_63":14,"_64":40,"_65":343,"_67":-5,"_68":-5,"_69":344,"_71":345,"_73":346,"_75":-5},[],[],[],[],"ama-sdk-openapi-codegen-typescript","github-actions-yarn-errors-reporter","ama-style-dictionary","ama-stylelint-plugin","ama-figma-extractor","training-tools","ama-openapi-redocly-plugin","training-sdk","training-showcase-sdk","ama-sdk-swagger-builder","ama-sdk-client-angular","github-actions-get-npm-tag","github-actions-new-version","ama-figma-sdk","ama-sdk-client-beacon","artifactory-tools","ama-sdk-client-fetch","dynamic-content","ama-openapi-create","ama-sdk-schematics","ama-styling-devkit","github-actions-release","workspace-helpers","configuration","eslint-config","eslint-plugin","ama-mfe-messages","ama-mfe-ng-utils","ama-openapi-core","apis-manager","github-actions-audit","localization","rules-engine","test-helpers","ama-mcp-angular","ama-openapi-cli","application","azure-tools","github-cascading-app","new-version","third-party","ama-mcp-github","ama-sdk-create","build-helpers","components","extractors","schematics","store-sync","ama-mcp-otter","analytics","telemetry","transloco","ama-mcp-core","ama-sdk-core","o3r-palette-generator","pipeline","ama-styling-mcp","routing","testing","vscode-extension","chrome-devtools","create","logger","mobile","forms","core","ama-sdk-mcp","mcp","showcase",{"_217":218,"_105":219,"_149":220,"_151":221,"_222":223,"_224":225,"_226":-5,"_227":40,"_228":-5,"_229":-5,"_230":-5,"_231":232,"_233":40,"_234":235,"_236":14,"_237":417,"_239":240,"_241":242,"_243":-5,"_244":245,"_246":418,"_248":249,"_250":-5,"_251":14,"_252":253,"_254":255},[],{},["D",1676055838344],"type","PRIMARY","publicCloudCounterpartId","privateCloudCounterpartId","installationSource","user","remoteSourceIntegrationType","GITHUB_EVENTLESS","featureMarkers",{"_462":40,"_463":14,"_464":40},"manualSetAccessLevel","idAccessLevel","READ_ONLY","patAccessLevel",{"_455":100,"_456":457,"_458":459,"_460":461},"flakyTaskConfiguration",{"_451":452,"_453":454},"aiTaskFixingConfiguration",{"_60":40,"_61":40,"_62":40,"_63":14,"_64":40,"_65":447,"_68":-5,"_69":448,"_71":449,"_73":450},"enableWorkspaceDataCaching","showVcsStatusChecks","defaultBranch","main","visibility","ALLOW_UNAUTHENTICATED","sandboxingConfiguration","launchTemplate",[],[],[],[],"threshold","NORMAL","samplePeriodDays",28,"provider","repositoryFullName","AmadeusITGroup/otter","repositoryId","589619867","repositoryVisibility","PUBLIC","isRemoteCachingActive","isDistributedTaskExecutionActive","isVCSIntegrationActive","currentUser","currentHostname","cloud.nx.app","incident",["P",469],"notifications",["P",471],"isSingleTenant","isPATExpiryAfterLoginEnabled","isOrganizationAccessEnabled","isExecutiveReportDisabled","loginas","repositoryAccessProvidersToOffer",[],"redirectTo","/cipes/6acf5709b04c861ab9093790/self-healing?runGroup=38548607759-1","deferredUserOrganizations",["P",482],"sidebarCollapsed","toast","currentUserId","currentUserEmail","signedInUser","isImpersonating","isBotRequest","ENV",{"_555":40,"_128":14,"_556":40,"_557":40,"_558":40,"_559":560,"_561":562,"_563":14,"_564":565,"_566":567,"_495":568},"posthogBootstrap",{"_525":526,"_527":528},"ultracacheUiEnabled","pylon",{"_517":518,"_519":520,"_45":521,"_522":-7,"_523":524},"requestInfo",{"_499":500,"_501":127,"_502":503,"_504":505,"_506":507},"hints",{"_510":513,"_515":516},"origin","path","/cipes/6acf5709b04c861ab9093790/self-healing","url","https://cloud.nx.app/cipes/6acf5709b04c861ab9093790/self-healing","userPreferences",{"_508":509},"theme",{"_45":253,"_510":511,"_512":513,"_514":513},"variant","system","resolvedVariant","light","clientColorScheme","timeZone","UTC","appId","a1074fe2-8172-4ebd-9889-879f8308a0a2","email","005a230b-f0f3-41cf-825a-0e6ee621415d@nxcloud.invalid","Anonymous Nx Cloud Visitor","avatarUrl","emailHash","cf0ae1117d83ddd10d2e95194774dffae41b3392a6e19a0d7ded6bf341bbc739","distinctID","005a230b-f0f3-41cf-825a-0e6ee621415d","featureFlags",{"_529":40,"_530":40,"_531":40,"_532":40,"_533":60,"_534":40,"_535":40,"_536":537,"_538":14,"_539":40,"_540":40,"_541":40,"_542":40,"_543":544,"_545":14,"_546":40,"_547":14,"_548":40,"_549":60,"_550":40,"_551":14,"_552":40,"_553":554},"automated_add_ons","non_dte_resource_usage","survey-targeting-8e88152ae4-custom","show_setup_self_healing_ci_alert","one_page_connect_workspace_gitlab","demo-mode","workspace_rewind","one_page_connect_workspace_manual","test","new_layout","workspace_badges","pylon_chat","teams_minimum_spend","resource_usage_toggle","cnw_empty_workspace_position","treatment","cipe_execution_timeline","new_access_control","run_details_polling","workspace_sandboxing_toggle","one_page_connect_workspace_github","resource_addon_default","feature_activation_guide","config_yaml","welcome_view_cnw_experiment","variant-2","isProduction","isAnalyticsEnabled","isPosthogEnabled","isPylonEnabled","privateCloud",{"_587":578,"_126":127},"auth0",{"_581":582,"_583":584,"_585":586},"e2eTestMode","rollbar",{"_573":574,"_575":576,"_60":40,"_577":578,"_579":40,"_580":40},"posthog",{"_569":570,"_571":572},{"_517":518},"apiKey","phc_eTmACxF0EKeNRjAZbfpdszbHYumyKhWqsIpMU4Wi53c","apiHost","https://pha-prx.ops.cloud.nx.app","accessToken","d0e4070ed1d54ed29429808f497ffbab3e77f1c74c2a9427fa5c5e418eea62ca96294bc716a7e8210acf93f0d37b6d29","environment","production","codeVersion","2610.14.0002","captureUncaught","captureUnhandledRejections","domain","auth.nx.app","clientId","Ron6k221B4IaH0QK9hmHuCneTovLLPpX","audience","https://api.nrwl.io/","containerVersionTimestamp"]

No suggested fixes