[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12},"actionData","errors","root",{"_490":-7,"_491":-5,"_492":-5,"_493":-5,"_494":14,"_495":40,"_496":497,"_498":499,"_500":14,"_501":502,"_503":504,"_37":38,"_39":40},"routes/_auth",{"_471":-5,"_472":473,"_474":475,"_476":477,"_134":14,"_33":14,"_478":14,"_479":14,"_480":14,"_481":14,"_482":-7,"_483":484,"_485":486,"_487":488,"_489":14,"_37":38,"_39":40},"routes/_auth.cipes.$cipeId",{"_20":108,"_109":14,"_110":-5,"_18":111,"_112":113,"_114":-5,"_115":116,"_117":14,"_118":40,"_119":14,"_15":-5,"_120":-5,"_121":14,"_122":123,"_124":-7,"_22":14,"_125":14,"_126":40,"_127":128,"_129":130,"_131":128,"_132":133,"_134":14,"_135":14,"_136":14,"_137":40,"_138":40,"_139":140,"_141":142,"_143":14,"_144":-5,"_37":38,"_39":40,"_145":146},"routes/_auth.cipes.$cipeId.self-healing",{"_13":14,"_15":-5,"_16":-5,"_17":-5,"_18":19,"_20":21,"_22":14,"_23":14,"_24":-5,"_25":-5,"_26":-5,"_27":-5,"_28":29,"_30":14,"_31":14,"_32":-5,"_33":14,"_34":14,"_35":-5,"_36":14,"_37":38,"_39":40},"hasRightToTakeAction",false,"aiFix","triggeredCipeId","existingFeedback","ciPipelineExecution",{"_41":47,"_48":49,"_50":51,"_52":53,"_54":55},"workspace",{"_41":42,"_43":44,"_45":46},"multipleFailuresWithoutFixes","showLogsButton","isFork","isDraft","actionByInfo","autoApplySuggestion","userDismissedTaskTypes",[],"autoApplyAlreadyEnabled","canEnableAutoApply","claudeStatus","isSystemAdmin","hasSuggestedFixFailureReasonDetails","firstAiFixAgentStepUrl","throttleAlreadyDismissed","result","success","ok",true,"_id","63e6951e043da20dd8321aec","orgId","63e68e668b89af000d2644c4","name","@o3r/framework","6acf57e1804b872e0a4c1755","branch","gh-readonly-queue/main/pr-4514-31da3deaf8c0a53b92eec04e344bc6faa0a4bae9","vcsContext",{"_48":49,"_85":49,"_86":87,"_88":89,"_90":-5,"_91":-5,"_92":93,"_94":95,"_96":97,"_98":99,"_100":101,"_102":103,"_104":105,"_106":107,"_24":-5,"_25":-5},"selfHealing",{"_62":63,"_64":65,"_66":14},"selfHealingSkipInfo",{"_56":57,"_58":59,"_60":61},"reason","MERGE_QUEUE_NOT_SUPPORTED","message","Self-Healing CI is not yet supported for GitHub merge queue runs. This CI run will continue without generating an AI fix.","recordedAt",["D",1791973803264],"cliOverrides",{"_83":-5,"_84":-5},"workspaceConfigSnapshot",{"_67":40,"_68":40,"_69":40,"_70":14,"_71":40,"_72":73,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":81,"_82":-5},"isLongLivedBranch","enabled","commentNotificationEnabled","allowAnonymousExternalCommand","enableFlakyRerunsAutomatically","allowDraftPullRequests","protectedBranchPatterns",[],"selfHealingCISetupCompletedAt","fixPatterns","neverFixPatterns",[],"autoApplyIncludePatterns",[],"autoApplyExcludePatterns",[],"formatCommand","fixTasks","autoApplyFixes","ref","title","chore(deps): update dependency js-yaml to v5.4.1 [security] (main) (#4514)\n\nThis PR contains the following updates:\n\n| Package | Change |\n[Age](https://docs.renovatebot.com/merge-confidence/) |\n[Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [js-yaml](https://redirect.github.com/nodeca/js-yaml) | [`5.2.2` →\n`5.4.1`](https://renovatebot.com/diffs/npm/js-yaml/5.2.2/5.4.1) |\n![age](https://developer.mend.io/api/mc/badges/age/npm/js-yaml/5.4.1?slim=true)\n|\n![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/js-yaml/5.2.2/5.4.1?slim=true)\n|\n\n---\n\n### JS-YAML: Quadratic-complexity DoS in merge key handling via repeated\naliases\n[CVE-2026-53550](https://nvd.nist.gov/vuln/detail/CVE-2026-53550) /\n[GHSA-h67p-54hq-rp68](https://redirect.github.com/advisories/GHSA-h67p-54hq-rp68)\n\n

More information

\n\n#### Details\n##### Summary\nA crafted YAML document can trigger algorithmic CPU exhaustion in\n`js-yaml` merge-key processing (`<<`) by repeating the same alias many\ntimes in a merge sequence.\nThis causes quadratic parse-time behavior relative to input size and can\nblock a Node.js worker/event loop for seconds with a relatively small\npayload (tens of KB), resulting in denial of service.\n\n##### Details\nThe issue is in merge handling inside `lib/loader.js`:\n\n- `storeMappingPair(...)` iterates every element of a merge sequence\nwhen key tag is `tag:yaml.org,2002:merge`.\n- For each element, it calls `mergeMappings(...)`.\n- `mergeMappings(...)` computes `Object.keys(source)` and performs\n`_hasOwnProperty.call(destination, key)` checks for each key.\n\nWhen input is of the form:\n\na: &a {k0:0, k1:0, ..., kK:0}\nb: {<<: [*a, *a, *a, ... repeated M times ...]}\nall *a entries refer to the same anchored object. After the first merge,\nsubsequent merges are semantically no-ops, but the parser still\nreprocesses all keys each time.\nResulting work is O(K * M), while input size is O(K + M), giving\nquadratic scaling as payload grows.\nRelevant code path:\nlib/loader.js in storeMappingPair(...) merge branch (keyTag ===\n'tag:yaml.org,2002:merge')\nlib/loader.js mergeMappings(...)\n\n##### Root cause\nFile: lib/loader.js\nFunction: storeMappingPair(state, _result, overridableKeys, keyTag,\nkeyNode,\nvalueNode, startLine, startLineStart, startPos)\nLines: ~359-366\n\n if (keyTag === 'tag:yaml.org,2002:merge') {\n if (Array.isArray(valueNode)) {\nfor (index = 0, quantity = valueNode.length; index < quantity; index +=\n1) {\nmergeMappings(state, _result, valueNode[index], overridableKeys);\n }\n } else {\n mergeMappings(state, _result, valueNode, overridableKeys);\n }\n }\n\nWhen the merge value is a sequence (YAML 1.1 <<: [ *a, *a, ... ]), each\nelement\nis handed to mergeMappings() without deduplication. mergeMappings() then\ndoes\n\n sourceKeys = Object.keys(source);\n for (index = 0; index < sourceKeys.length; index += 1) {\n key = sourceKeys[index];\n if (!_hasOwnProperty.call(destination, key)) {\n setProperty(destination, key, source[key]);\n overridableKeys[key] = true;\n }\n }\n\nEvery alias reference in the sequence resolves (by design) to the SAME\nobject\nvia state.anchorMap. After the first merge, every subsequent merge of\nthat same\nreference is a pure no-op semantically, but still performs:\n\n * one Object.keys(source) call (O(K))\n * K _hasOwnProperty.call checks on the destination\n\nTotal: M * K hasOwnProperty checks + M Object.keys allocations, while\nthe final\nobject and all observable side effects are identical to a single merge.\n\nYAML semantics for `<<:` are idempotent and commutative over duplicate\nsources,\nso collapsing duplicates preserves behavior exactly; this isn't a spec\ntrade-off.\n\n##### PoC\nEnvironment:\njs-yaml version: 4.1.1\nNode.js: v24.5.0\nPlatform: arm64 macOS (reproduced consistently)\nReproduction script:\nCreate many keys in one anchored map (&a).\nMerge that same alias repeatedly via <<: [*a, *a, ...].\nMeasure parse time and compare with control payload using single merge\n(<<: *a).\nObserved repeated runs (same machine):\nK=M=1000, input 9,909 bytes: ~33–36 ms\nK=M=2000, input 20,909 bytes: ~121–123 ms\nK=M=4000, input 42,909 bytes: ~524–537 ms\nK=M=6000, input 64,909 bytes: ~1,608–1,829 ms\nK=M=8000, input 86,909 bytes: ~3,395–3,565 ms\nControl (single merge, similar key counts):\nK=2000: ~1–2 ms\nK=4000: ~3 ms\nK=8000: ~5 ms\nAlso verified: repeated-merge output equals single-merge output (same\nkey count and same JSON), confirming excess time is redundant\ncomputation.\n\n##### Impact\nThis is a denial-of-service vulnerability (CPU exhaustion / algorithmic\ncomplexity).\nAny service parsing untrusted YAML with js-yaml can be impacted,\nincluding API backends, CI tools, config processors, and automation\nservices. An attacker can submit crafted YAML to significantly increase\nCPU time and reduce availability.\n\n##### Suggested fix:\nDedupe the merge source list by reference before invoking mergeMappings.\nAny of\nthe following are minimal and preserve YAML 1.1 merge semantics:\n\ndedupe in storeMappingPair:\n\n if (keyTag === 'tag:yaml.org,2002:merge') {\n if (Array.isArray(valueNode)) {\n var seen = new Set();\nfor (index = 0, quantity = valueNode.length; index < quantity; index +=\n1) {\n var src = valueNode[index];\nif (seen.has(src)) continue; // idempotent; skip redundant alias\n seen.add(src);\n mergeMappings(state, _result, src, overridableKeys);\n }\n } else {\n mergeMappings(state, _result, valueNode, overridableKeys);\n }\n }\n\n#### Severity\n- CVSS Score: 5.3 / 10 (Medium)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`\n\n#### References\n-\n[https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68](https://redirect.github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68)\n-\n[https://nvd.nist.gov/vuln/detail/CVE-2026-53550](https://nvd.nist.gov/vuln/detail/CVE-2026-53550)\n-\n[https://github.com/advisories/GHSA-h67p-54hq-rp68](https://redirect.github.com/advisories/GHSA-h67p-54hq-rp68)\n\nThis data is provided by the [GitHub Advisory\nDatabase](https://redirect.github.com/advisories/GHSA-h67p-54hq-rp68)\n([CC-BY\n4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n

\n\n---\n\n### js-yaml: YAML merge-key chains can force quadratic CPU consumption\n[CVE-2026-59869](https://nvd.nist.gov/vuln/detail/CVE-2026-59869) /\n[GHSA-52cp-r559-cp3m](https://redirect.github.com/advisories/GHSA-52cp-r559-cp3m)\n\n

More information

\n\n#### Details\n##### Impact\n\njs-yaml can spend quadratic CPU time parsing a document whose size grows\nonly linearly. The issue is triggered by a chain of mappings where each\nmapping merges the previous one:\n\n```yaml\na0: &a0 { k0: 0 }\na1: &a1 { <<: *a0, k1: 1 }\na2: &a2 { <<: *a1, k2: 2 }\na3: &a3 { <<: *a2, k3: 3 }\n...\nb: *aN\n```\n\nFor each new mapping, the loader has to enumerate the keys inherited\nfrom the previous mapping. With N chained mappings, this results in\nroughly 1 + 2 + ... + N merged-key visits, i.e., O(N^2) work for O(N)\ninput size.\n\n##### PoC\n\nFrom N = 4000 delay become > 1s (doc size < 100K)\n\n```js\nimport { performance } from 'node:perf_hooks'\nimport { Buffer } from 'node:buffer'\nimport { load, YAML11_SCHEMA } from 'js-yaml'\n\nconst n = Number(process.argv[2] || 4000)\n\nfunction makeMergeChain (count) {\n const lines = ['a0: &a0 { k0: 0 }']\n\n for (let i = 1; i < count; i++) {\n lines.push(`a${i}: &a${i} { <<: *a${i - 1}, k${i}: ${i} }`)\n }\n\n lines.push(`b: *a${count - 1}`)\n return `${lines.join('\\n')}\\n`\n}\n\nconst source = makeMergeChain(n)\n\nconsole.log(source.split('\\n').slice(0, 8).join('\\n'))\nconsole.log('...')\nconsole.log(source.split('\\n').slice(-4).join('\\n'))\nconsole.log()\nconsole.log(`N: ${n}`)\nconsole.log(`YAML size: ${Buffer.byteLength(source)} bytes`)\n\nconst started = performance.now()\nconst result = load(source, { schema: YAML11_SCHEMA })\nconst elapsed = performance.now() - started\n\nconsole.log(`parse time: ${elapsed.toFixed(1)} ms`)\nconsole.log(`top-level keys: ${Object.keys(result).length}`)\nconsole.log(`b keys: ${Object.keys(result.b).length}`)\n```\n\n##### Patches\n\nFix released. The most robust protection is to limit the total number of\nmerged keys per parse call. This should close all past and future edge\ncases with merge. The default 10K-key limit should be okay in most\ncases.\n\n#### Severity\n- CVSS Score: 7.5 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n#### References\n-\n[https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m](https://redirect.github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m)\n-\n[https://nvd.nist.gov/vuln/detail/CVE-2026-59869](https://nvd.nist.gov/vuln/detail/CVE-2026-59869)\n-\n[https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7](https://redirect.github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7)\n-\n[https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4](https://redirect.github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4)\n-\n[https://github.com/nodeca/js-yaml/releases/tag/3.15.0](https://redirect.github.com/nodeca/js-yaml/releases/tag/3.15.0)\n-\n[https://github.com/nodeca/js-yaml/releases/tag/4.3.0](https://redirect.github.com/nodeca/js-yaml/releases/tag/4.3.0)\n-\n[https://github.com/advisories/GHSA-52cp-r559-cp3m](https://redirect.github.com/advisories/GHSA-52cp-r559-cp3m)\n\nThis data is provided by the [GitHub Advisory\nDatabase](https://redirect.github.com/advisories/GHSA-52cp-r559-cp3m)\n([CC-BY\n4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n

\n\n---\n\n### JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and\n4.x) — CVE-2026-59870 fix not backported\n\n[GHSA-5p4m-2wfm-xmqj](https://redirect.github.com/advisories/GHSA-5p4m-2wfm-xmqj)\n\n

More information

\n\n#### Details\n##### Quadratic CPU consumption in `!!omap` resolution (js-yaml 3.x and\n4.x)\n\n##### Summary\n\n`resolveYamlOmap()` enforces key uniqueness for `!!omap` sequences with\na linear\nscan (`objectKeys.indexOf(...)`) inside the per-element loop, making\nresolution\n**O(n²)** in the number of entries. A modestly sized YAML document\ntherefore\nconsumes disproportionate CPU inside `yaml.load()`, giving a denial of\nservice\nagainst any consumer that parses untrusted YAML.\n\n`!!omap` is registered in the **default schema**\n(`lib/schema/default.js` → `require('../type/omap')`), so a plain\n`yaml.load(untrustedInput)` with no options is affected — no custom\nschema or\nnon-default configuration is required.\n\n**This is the same weakness as CVE-2026-59870 / GHSA-724g-mxrg-4qvm**,\nwhich was\nfixed in the 5.x line in 5.2.1. That fix was never backported: both\ncurrently\nmaintained legacy lines still carry the original implementation.\n\n##### Affected versions\n\n| Line | Latest tested | Status |\n|---|---|---|\n| 3.x | **3.15.0** | Affected — `objectKeys.indexOf(pairKey)` at\n`lib/type/omap.js:29` |\n| 4.x | **4.3.0** | Affected — `objectKeys.indexOf(pairKey)` at\n`lib/type/omap.js:30` |\n| 5.x | 5.2.2 | **Not affected** — fixed in 5.2.1 (uses a `Set`) |\n\nBoth figures are the newest release of each line at the time of writing,\nso\nthis is not a \"you are on an old version\" issue.\n\n##### Details\n\n`lib/type/omap.js` (js-yaml 4.3.0):\n\n```js\nif (objectKeys.indexOf(pairKey) === -1) objectKeys.push(pairKey)\nelse return false\n```\n\n`objectKeys` grows by one element per entry, and\n`Array.prototype.indexOf` is a\nlinear scan, so resolving an `n`-entry `!!omap` performs roughly\n`1 + 2 + … + n` comparisons — quadratic in `n`. The work happens\nsynchronously\ninside `yaml.load()`, blocking the event loop for its whole duration.\n\nThe 5.x line already solves exactly this by tracking seen keys in a\n`Set`\n(`src/tag/sequence/omap.ts`):\n\n```ts\nif (carrier.seen.has(key)) return 'duplicate key in ordered map'\ncarrier.seen.add(key)\n```\n\n##### Proof of concept\n\n```js\n// poc.js — node poc.js\nconst yaml = require('js-yaml');\nconst doc = n => '!!omap\\n' + Array.from({length: n}, (_, i) => `- k${i}: ${i}`).join('\\n') + '\\n';\n\nfor (const n of [10000, 20000, 40000, 80000]) {\n const d = doc(n), t = Date.now();\n yaml.load(d); // default schema, no options\n console.log(`n=${n} bytes=${d.length} load=${Date.now() - t}ms`);\n}\n```\n\n##### Measured (node v20.20.2, default heap, no flags)\n\n**js-yaml 4.3.0**\n\n```\nn=10000 bytes=137787 load=54ms\nn=20000 bytes=297787 load=169ms\nn=40000 bytes=617787 load=646ms\nn=80000 bytes=1257787 load=2607ms\n```\n\n**js-yaml 3.15.0**\n\n```\nn=10000 bytes=137787 load=53ms\nn=20000 bytes=297787 load=166ms\nn=40000 bytes=617787 load=641ms\nn=80000 bytes=1257787 load=2567ms\n```\n\nRuntime grows by a factor of ~4 for each doubling of `n`, which is the\nsignature of O(n²) (linear growth would be ~2×).\n\nScaling further: a **2.48 MB** document with 150,000 entries blocked\n`yaml.load()` for **10.8 seconds**.\n\n##### Impact\n\nAny service that parses attacker-influenced YAML with js-yaml 3.x or 4.x\ncan be\nstalled with a small input. Because the loop is synchronous, a single\nrequest\nblocks the Node.js event loop and stalls every other request in the\nprocess —\nso the amplification is per-process, not just per-request.\n\nSuggested severity: consistent with **CVE-2026-59870** (the same\nweakness in\n5.x), i.e. Availability-only impact, network attack vector, no\nprivileges or\nuser interaction required.\n\n##### Suggested fix\n\nMirror the 5.x fix — replace the linear scan with a `Set`:\n\n```js\n// lib/type/omap.js\nconst seen = new Set()\n// ...\nif (seen.has(pairKey)) return false\nseen.add(pairKey)\n```\n\nThis preserves the existing duplicate-key rejection semantics exactly\nwhile\nmaking resolution O(n). A `maxOmapLength`-style cap would also work, but\nthe\n`Set` matches what 5.x already ships and requires no new option.\n\n##### References\n\n- CVE-2026-59870 / GHSA-724g-mxrg-4qvm — same weakness in 5.0.0–5.2.0,\nfixed in 5.2.1\n- `lib/type/omap.js` (3.x, 4.x) — the affected resolver\n- `lib/schema/default.js` — registers `!!omap` in the default schema\n\n##### Discovery\n\nFound by an automated static-analysis and executed-proof-of-concept\nscanner run\nagainst js-yaml 4.2.0, then manually verified against 3.15.0 and 4.3.0\nby\nexecuting the proof of concept above. All timings in this report were\nmeasured\non the **current** releases of each line, not on the version originally\nscanned.\n\n#### Severity\n- CVSS Score: 7.5 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n#### References\n-\n[https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj](https://redirect.github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n-\n[https://github.com/advisories/GHSA-5p4m-2wfm-xmqj](https://redirect.github.com/advisories/GHSA-5p4m-2wfm-xmqj)\n\nThis data is provided by the [GitHub Advisory\nDatabase](https://redirect.github.com/advisories/GHSA-5p4m-2wfm-xmqj)\n([CC-BY\n4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n

\n\n---\n\n### js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge\nsources\n[CVE-2026-84375](https://nvd.nist.gov/vuln/detail/CVE-2026-84375) /\n[GHSA-2883-xcg3-v3hh](https://redirect.github.com/advisories/GHSA-2883-xcg3-v3hh)\n\n

More information

\n\n#### Details\n##### Summary\n\n`maxTotalMergeKeys` does not count empty mappings. An attacker can\nrepeatedly merge a large sequence of them and consume significant CPU\nwithout reaching the configured limit.\n\n##### Example\n\n```yaml\narr: &arr [{}, {}, {}, ...] # N empty mappings\ntargets:\n - <<: *arr # repeated K times\n```\n\nFor every target, the loader iterates all `N` elements of `arr`. This\nresults in `O(N * K)` work while `totalMergeKeys` remains unchanged.\n\n##### PoC\n\n```js\nimport { performance } from 'node:perf_hooks'\nimport { load, YAML11_SCHEMA } from 'js-yaml'\n\nconst n = 20000\n\nconst src =\n 'arr: &arr [' + '{},'.repeat(n).slice(0, -1) + ']\\n' +\n 'targets:\\n' +\n ' - <<: *arr\\n'.repeat(n)\n\nconst started = performance.now()\n\nload(src, { schema: YAML11_SCHEMA })\n\nconsole.log(`${(performance.now() - started).toFixed(1)} ms`)\n```\n\nObserved results:\n\n| N | YAML size | Time |\n|---:|---:|---:|\n| 800 | ~13 KB | ~20 ms |\n| 3200 | ~50 KB | ~180 ms |\n| 20000 | ~500 KB | ~13 s |\n\n##### Impact\n\nAn attacker can submit a relatively small YAML document that causes\nprolonged CPU consumption despite the default `maxTotalMergeKeys` limit.\n\n##### Fix\n\nCount each merge-source mapping as one budget unit, in addition to\ncounting its keys.\n\n##### Difference with v5\n\nIn v3 & v4, merge is enabled by default. So, the severity score is\nhigher.\n\n#### Severity\n- CVSS Score: 7.5 / 10 (High)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n#### References\n-\n[https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh](https://redirect.github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n-\n[https://nvd.nist.gov/vuln/detail/CVE-2026-84375](https://nvd.nist.gov/vuln/detail/CVE-2026-84375)\n-\n[https://github.com/nodeca/js-yaml/pull/797](https://redirect.github.com/nodeca/js-yaml/pull/797)\n-\n[https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639](https://redirect.github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n-\n[https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480](https://redirect.github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n-\n[https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b](https://redirect.github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n-\n[https://github.com/nodeca/js-yaml/releases/tag/3.15.2](https://redirect.github.com/nodeca/js-yaml/releases/tag/3.15.2)\n-\n[https://github.com/nodeca/js-yaml/releases/tag/4.3.2](https://redirect.github.com/nodeca/js-yaml/releases/tag/4.3.2)\n-\n[https://github.com/advisories/GHSA-2883-xcg3-v3hh](https://redirect.github.com/advisories/GHSA-2883-xcg3-v3hh)\n\nThis data is provided by the [GitHub Advisory\nDatabase](https://redirect.github.com/advisories/GHSA-2883-xcg3-v3hh)\n([CC-BY\n4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n

\n\n---\n\n### js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge\nsources\n\n[GHSA-r3ph-w7gj-g6xm](https://redirect.github.com/advisories/GHSA-r3ph-w7gj-g6xm)\n\n

More information

\n\n#### Details\n##### Summary\n\n`maxTotalMergeKeys` does not count empty mappings. An attacker can\nrepeatedly merge a large sequence of them and consume significant CPU\nwithout reaching the configured limit.\n\n##### Example\n\n```yaml\narr: &arr [{}, {}, {}, ...] # N empty mappings\ntargets:\n - <<: *arr # repeated K times\n```\n\nFor every target, the loader iterates all `N` elements of `arr`. This\nresults in `O(N * K)` work while `totalMergeKeys` remains unchanged.\n\n##### PoC\n\n```js\nimport { performance } from 'node:perf_hooks'\nimport { load, YAML11_SCHEMA } from 'js-yaml'\n\nconst n = 20000\n\nconst src =\n 'arr: &arr [' + '{},'.repeat(n).slice(0, -1) + ']\\n' +\n 'targets:\\n' +\n ' - <<: *arr\\n'.repeat(n)\n\nconst started = performance.now()\n\nload(src, { schema: YAML11_SCHEMA })\n\nconsole.log(`${(performance.now() - started).toFixed(1)} ms`)\n```\n\nObserved results:\n\n| N | YAML size | Time |\n|---:|---:|---:|\n| 800 | ~13 KB | ~20 ms |\n| 3200 | ~50 KB | ~180 ms |\n| 20000 | ~500 KB | ~13 s |\n\n##### Impact\n\nWhen merge keys are enabled, an attacker can submit a relatively small\nYAML document that causes prolonged CPU consumption despite the default\n`maxTotalMergeKeys` limit.\n\n##### Fix\n\nCount every merge source mapping as one budget unit in addition to\ncounting its keys.\n\n#### Severity\n- CVSS Score: 5.3 / 10 (Medium)\n- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`\n\n#### References\n-\n[https://github.com/nodeca/js-yaml/security/advisories/GHSA-r3ph-w7gj-g6xm](https://redirect.github.com/nodeca/js-yaml/security/advisories/GHSA-r3ph-w7gj-g6xm)\n-\n[https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480](https://redirect.github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n-\n[https://github.com/nodeca/js-yaml/releases/tag/5.4.1](https://redirect.github.com/nodeca/js-yaml/releases/tag/5.4.1)\n-\n[https://github.com/advisories/GHSA-r3ph-w7gj-g6xm](https://redirect.github.com/advisories/GHSA-r3ph-w7gj-g6xm)\n\nThis data is provided by the [GitHub Advisory\nDatabase](https://redirect.github.com/advisories/GHSA-r3ph-w7gj-g6xm)\n([CC-BY\n4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n

\n\n---\n\n### Release Notes\n\n

nodeca/js-yaml (js-yaml)

\n\n###\n[`v5.4.1`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#541---2026-08-26)\n\n[Compare\nSource](https://redirect.github.com/nodeca/js-yaml/compare/5.4.0...5.4.1)\n\n##### Changed\n\n- Hard-limit merge sequence size to 100.\n\n##### Security\n\n- Count empty mappings in merge sequences toward `maxTotalMergeKeys` to\nlimit\nCPU usage,\n[#797](https://redirect.github.com/nodeca/js-yaml/issues/797).\n\n###\n[`v5.4.0`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#540---2026-08-25)\n\n[Compare\nSource](https://redirect.github.com/nodeca/js-yaml/compare/5.3.0...5.4.0)\n\n##### Added\n\n- Added the `scalarStyleRules` dumper option to customize string\nformatting.\n See [Scalar styling](docs/scalar_styling.md) for details.\n\n##### Changed\n\n- \\[breaking] Flattened the low-level AST node style representation.\nScalar\nand collection nodes now use `SCALAR_STYLE` and `COLLECTION_STYLE`\nvalues;\nexplicit tags use the separate `tagged` property. Alias nodes now\ncontain\nonly `kind` and `anchor`. This only affects code that directly\nconstructs or\n edits AST nodes.\n- \\[breaking] The `sortKeys` option was rewritten using AST mutation to\navoid\n side effects.\n- Reworked scalar style selection. This can change formatting without\nchanging\nloaded values; in particular, whitespace-only strings are now\ndouble-quoted.\n\n##### Fixed\n\n- Accept a byte order mark at the start of each document in a stream,\n[#791](https://redirect.github.com/nodeca/js-yaml/issues/791).\n- Produce valid flow mappings with `quoteFlowKeys` and\n`flowSkipColonSpace`,\nincluding alias and property-only keys,\n[#786](https://redirect.github.com/nodeca/js-yaml/issues/786).\n- Preserve empty scalar items when converting block sequences to flow\nstyle.\n- Do not apply the 1024-character simple-key limit to flow mapping keys.\n- Count Unicode code points, rather than UTF-16 code units, for the\n 1024-character simple-key limit.\n- Add an explicit document-end marker after keep-chomped block scalars\nwhen\n needed to preserve trailing newlines.\n\n###\n[`v5.3.0`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#530---2026-08-14)\n\n[Compare\nSource](https://redirect.github.com/nodeca/js-yaml/compare/5.2.3...5.3.0)\n\nThis release focuses on reworking the documentation and making small\narchitectural improvements before moving forward.\n\n##### Added\n\n- Added completely new documentation.\n- Exported `DUMP_SCHEMA`, the default schema used by the dumper.\n- Added `YAMLException.throwAt()` for throwing an error at a source\nposition.\n\n##### Changed\n\n- Changed flat constant exports to grouped exports: `EVENT_ID`,\n`SCALAR_STYLE`,\n`COLLECTION_STYLE`, and `CHOMPING_MODE`, along with their value types.\nThe old\n exports are still preserved, but deprecated.\n- Made `identify` mandatory for custom tag definitions. Use\n `identify: () => false` for load-only tags.\n\n##### Deprecated\n\n- Deprecated flat constant exports. Use grouped ones instead.\n\n##### Removed\n\n- Removed the `MERGE_KEY` export (not used anymore after last fixes).\n\n##### Fixed\n\n- Validate `<<` sequence items at merge time, so aliased merge sources\nare\n checked too.\n- Resolve `<<` outside of a mapping key as the plain string `'<<'`,\nmatching\n v4, instead of leaking an internal symbol into the result.\n\n###\n[`v5.2.3`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#523---2026-08-01)\n\n[Compare\nSource](https://redirect.github.com/nodeca/js-yaml/compare/5.2.2...5.2.3)\n\n##### Fixed\n\n- Prevent prototype fallback when resolving tags and mapping entries,\n[#782](https://redirect.github.com/nodeca/js-yaml/issues/782).\n- Resolve `!!timestamp` years 0000-0099 correctly,\n[#775](https://redirect.github.com/nodeca/js-yaml/issues/775).\n- Preserve implicit null mapping values before document markers and\nreject\nunpaired mapping event streams,\n[#784](https://redirect.github.com/nodeca/js-yaml/issues/784).\n- Preserve folded scalar values with tab-indented lines when\nround-tripping a\nparsed AST through `present()`; `dump()` and loading are unaffected,\n[#780](https://redirect.github.com/nodeca/js-yaml/issues/780).\n\n

\n\n---\n\n### Configuration\n\n📅 **Schedule**: (in timezone Europe/Paris)\n\n- Branch creation\n - At any time (no schedule defined)\n- Automerge\n - At any time (no schedule defined)\n\n🚦 **Automerge**: Enabled.\n\n♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the\nrebase/retry checkbox.\n\n🔕 **Ignore**: Close this PR and you won't be reminded about this update\nagain.\n\n---\n\n- [ ] If you want to rebase/retry this PR, check\nthis box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).\nView the [repository job\nlog](https://developer.mend.io/github/AmadeusITGroup/otter).\n\n","headSha","5031951ced722c8d62effdc5449b1348485f6a40","baseSha","parentShas","commitLink","https://github.com/AmadeusITGroup/otter/commit/5031951ced722c8d62effdc5449b1348485f6a40","author","Florian PAUL","authorEmail","110407799+fpaul-1A@users.noreply.github.com","authorUrl","https://github.com/fpaul-1a","authorAvatarUrl","https://github.com/fpaul-1a.png","repositoryUrl","https://github.com/AmadeusITGroup/otter","platformName","GITHUB_ACTIONS","runnerProvider","GITHUB",{"_41":42,"_43":44,"_154":425,"_45":46,"_67":40,"_426":427,"_428":-5,"_429":-5,"_430":431,"_432":433,"_434":435,"_436":40,"_437":438,"_439":438,"_180":440,"_441":442,"_443":444,"_445":40,"_446":40,"_447":448,"_449":450,"_451":-7,"_452":-7},"isAdmin","membership",{"_41":47,"_317":42,"_318":224,"_48":49,"_154":319,"_156":320,"_227":321,"_322":323,"_50":324,"_229":230,"_325":14,"_326":-5,"_327":328,"_329":330,"_331":332,"_333":334,"_335":-5,"_336":40,"_337":-5,"_83":-5,"_84":-5,"_52":338,"_54":339,"_340":-5,"_341":-5,"_342":-5,"_343":-5,"_344":-5,"_345":-5},"runGroup",{"_222":223,"_112":224,"_154":225,"_156":226,"_227":228,"_229":230,"_231":-5,"_232":40,"_233":-5,"_234":-5,"_235":-5,"_236":237,"_238":40,"_239":240,"_241":14,"_242":243,"_244":245,"_246":247,"_248":-5,"_249":250,"_251":252,"_253":254,"_255":-5,"_256":14,"_257":258,"_259":260},"cancellationTriggeringUserName","organization",{"_45":153,"_154":155,"_156":157,"_151":40,"_158":159,"_67":40,"_160":161,"_162":163,"_164":14,"_165":166,"_167":40,"_168":169,"_170":44,"_41":44,"_171":172,"_173":-7,"_174":14,"_175":14,"_176":14,"_177":14,"_178":14,"_179":-5,"_180":-5,"_181":-5,"_182":14,"_183":-5,"_184":-7},"shouldCompleteAccessControlSetup","isWorkspaceClaimed","isCurrentUserOrganizationMember","mostRecentCipeForBranch","supersededOnBranch","attempts",[],"guideMilestoneStatus","isResourceUsageAvailable","isCipeExecutionTimelineEnabled","cappedCiPipelineExecutionCount",10,"currentUsagePercentage",71,"contributorsCount","nxCloudAppUrl","https://cloud.nx.app","isPrivateCloud","isSandboxingToggleEnabled","isUltracacheUiEnabled","isSandboxingPreviewEligible","isResourceUsagePreviewEligible","organizationActor",{"_150":151,"_152":14},"settingsDestinations",[],"managedCiNavigation","pipelinePreview","managedContext",{"_147":148,"_149":-5},"loadedAt",1792069101998,"managed","access","public","isInternalAdmin","AmadeusITGroup","createdAt",["D",1676054118998],"updatedAt",["D",1681913345534],"allowedEmailDomains",[221],"plan","OSS","planActivationDate",["D",1686144031537],"isEligibleForProTrial","planLimits",{"_205":206,"_207":208,"_209":210,"_211":212,"_213":212,"_214":215,"_216":217,"_218":217,"_219":220},"isAiEnabled","planTransitions",[],"id","memberships",[185,186,187,188,189,190,191,192],"privateCloudInstallationId","hasBillingInformation","hasLicense","isUnclaimed","isOnTrial","isHighPriority","vcsProfileLink","vcsConfiguration","lastMembersSyncedAt","isAiBringYourOwnKey","enterpriseTrial","disabledReasonMessage",{"_193":204,"_195":196},{"_193":203,"_195":198},{"_193":202,"_195":196},{"_193":201,"_195":198},{"_193":200,"_195":198},{"_193":199,"_195":198},{"_193":197,"_195":198},{"_193":194,"_195":196},"userId","63eb8f0c1147ed000ed89147","role","admin","656f2a38d8c7f6f8d5bfdab5","member","64a51a42097e04000dcff5a3","63f5d0d76abadd000e2a636a","63ee2a741147ed000ed892b0","63ecec5bd91fa9000e2ebaa1","63ecec62d91fa9000e2ebaa3","63e68de49bae37000e41c9c6","baseIncludedCredits",300000,"additionalCredits",{},"discountedCreditsMaximum",0,"contributorLimit",70,"concurrentConnectionLimit","runsLimit",1000000,"adminUserLimit",9999,"workspaceLimit","modifiers",[],"amadeus.com","ciExecutionEnv","","38548607803-1",["D",1791973345824],["D",1791981269368],"completedAt",["D",1791981269368],"status","FAILED","agentCount","stopAgentsOnFailure","criticalErrorMessage","commandCount","stopAgentsAfter","agents",[],"closed","completedBy","HEARTBEAT","requireExplicitCompletion","linkedWorkflows",[],"activeAgents",[],"assignmentRules",[],"schedulingConstraintsInput","agentsMetadata",{},"agentInstances",{},"stopAgentsAfterConditions",{},"continuousAssignment","resourcePackingEnabled","packingDecisionReason","default","config",{"_261":262,"_222":-5},"sources",{"_263":264,"_265":266,"_267":268,"_269":270},"lifecycle",{"_306":307,"_308":309,"_310":311},"ai",{"_298":299,"_300":301},"dte",{"_278":279,"_280":281,"_246":282,"_283":284},"nxAgents",{"_271":272},"withEnvVars",[273],{"_274":275,"_276":277,"_222":-5},"kind","LEGACY","value",[],"enabledByDefault",[297],"distributeOn",[],[292],"schedulingConstraints",[285],{"_274":286,"_276":287,"_222":-5},"DEFAULT",{"_288":289,"_290":291},"_t","io.nrwl.models.SchedulingConstraintsInput.Inline","constraints",[],{"_274":286,"_276":293,"_222":-5},{"_288":294,"_295":296},"io.nrwl.models.AssignmentRulesInput.Inline","rules",[],{"_274":286,"_276":40,"_222":-5},"fixTasksPatterns",[304],"autoApplyPatterns",[302],{"_274":286,"_276":303,"_222":-5},[],{"_274":286,"_276":305,"_222":-5},[],"failAfter",[315],"heartbeat",[314],"stopAfter",[312],{"_274":275,"_276":313,"_222":-5},[],{"_274":275,"_276":40,"_222":-5},{"_274":275,"_276":316,"_222":-5},1,"workspaceId","ciExecutionId",["D",1791973345824],["D",1791981270133],["D",1791981269368],"runGroups",[422],{"_48":49,"_85":49,"_86":87,"_88":89,"_90":-5,"_91":-5,"_92":93,"_94":95,"_96":97,"_98":99,"_100":101,"_102":103,"_104":105,"_106":107,"_24":-5,"_25":-5},"cancellationRequested","affectedProjectRatio","touchedProjects",[],"affectedProjects",[353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,20,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421],"criticalWorkflowErrors",[],"projectGraphSha","a261da625698ef3b657b383597017f4851381c7da15e6e4e9be12e0525ccde95","fileMapSha","cacheEnabled","hashScope",{"_62":347,"_64":348,"_66":14},{"_56":57,"_58":59,"_60":346},"pipelineHeadSha","pipelineParentShas","ioSnapshotCommitGraph","ioSnapshotCommitGraphClaimedAt","managedCi","cancellation",["D",1791973803264],{"_83":-5,"_84":-5},{"_67":40,"_68":40,"_69":40,"_70":14,"_71":40,"_72":349,"_74":-5,"_75":-5,"_76":350,"_78":351,"_80":352,"_82":-5},[],[],[],[],"ama-sdk-openapi-codegen-typescript","github-actions-yarn-errors-reporter","ama-style-dictionary","ama-stylelint-plugin","ama-figma-extractor","training-tools","ama-openapi-redocly-plugin","training-sdk","training-showcase-sdk","ama-sdk-swagger-builder","ama-sdk-client-angular","github-actions-get-npm-tag","github-actions-new-version","ama-figma-sdk","ama-sdk-client-beacon","artifactory-tools","ama-sdk-client-fetch","dynamic-content","ama-openapi-create","ama-sdk-schematics","ama-styling-devkit","github-actions-release","workspace-helpers","configuration","eslint-config","eslint-plugin","ama-mfe-messages","ama-mfe-ng-utils","ama-openapi-core","apis-manager","github-actions-audit","localization","rules-engine","test-helpers","ama-mcp-angular","ama-openapi-cli","application","azure-tools","github-cascading-app","new-version","third-party","ama-mcp-github","ama-sdk-create","build-helpers","components","extractors","schematics","store-sync","ama-mcp-otter","analytics","telemetry","transloco","ama-mcp-core","ama-sdk-core","o3r-palette-generator","pipeline","ama-styling-mcp","routing","testing","vscode-extension","chrome-devtools","create","logger","mobile","forms","core","ama-sdk-mcp","mcp","showcase",{"_222":223,"_112":224,"_154":225,"_156":226,"_227":228,"_229":230,"_231":-5,"_232":40,"_233":-5,"_234":-5,"_235":-5,"_236":237,"_238":40,"_239":240,"_241":14,"_242":423,"_244":245,"_246":247,"_248":-5,"_249":250,"_251":424,"_253":254,"_255":-5,"_256":14,"_257":258,"_259":260},[],{},["D",1676055838344],"type","PRIMARY","publicCloudCounterpartId","privateCloudCounterpartId","installationSource","user","remoteSourceIntegrationType","GITHUB_EVENTLESS","featureMarkers",{"_468":40,"_469":14,"_470":40},"manualSetAccessLevel","idAccessLevel","READ_ONLY","patAccessLevel",{"_461":107,"_462":463,"_464":465,"_466":467},"flakyTaskConfiguration",{"_457":458,"_459":460},"aiTaskFixingConfiguration",{"_67":40,"_68":40,"_69":40,"_70":14,"_71":40,"_72":453,"_75":-5,"_76":454,"_78":455,"_80":456},"enableWorkspaceDataCaching","showVcsStatusChecks","defaultBranch","main","visibility","ALLOW_UNAUTHENTICATED","sandboxingConfiguration","launchTemplate",[],[],[],[],"threshold","NORMAL","samplePeriodDays",28,"provider","repositoryFullName","AmadeusITGroup/otter","repositoryId","589619867","repositoryVisibility","PUBLIC","isRemoteCachingActive","isDistributedTaskExecutionActive","isVCSIntegrationActive","currentUser","currentHostname","cloud.nx.app","incident",["P",475],"notifications",["P",477],"isSingleTenant","isPATExpiryAfterLoginEnabled","isOrganizationAccessEnabled","isExecutiveReportDisabled","loginas","repositoryAccessProvidersToOffer",[],"redirectTo","/cipes/6acf57e1804b872e0a4c1755/self-healing?runGroup=38548607803-1","deferredUserOrganizations",["P",488],"sidebarCollapsed","toast","currentUserId","currentUserEmail","signedInUser","isImpersonating","isBotRequest","ENV",{"_561":40,"_134":14,"_562":40,"_563":40,"_564":40,"_565":566,"_567":568,"_569":14,"_570":571,"_572":573,"_501":574},"posthogBootstrap",{"_531":532,"_533":534},"ultracacheUiEnabled","pylon",{"_523":524,"_525":526,"_45":527,"_528":-7,"_529":530},"requestInfo",{"_505":506,"_507":133,"_508":509,"_510":511,"_512":513},"hints",{"_516":519,"_521":522},"origin","path","/cipes/6acf57e1804b872e0a4c1755/self-healing","url","https://cloud.nx.app/cipes/6acf57e1804b872e0a4c1755/self-healing","userPreferences",{"_514":515},"theme",{"_45":258,"_516":517,"_518":519,"_520":519},"variant","system","resolvedVariant","light","clientColorScheme","timeZone","UTC","appId","a1074fe2-8172-4ebd-9889-879f8308a0a2","email","c8ad9466-ec43-4c53-9022-c536114e89c9@nxcloud.invalid","Anonymous Nx Cloud Visitor","avatarUrl","emailHash","a438850a378793268cf485d6e81e311ce6b92b89dba04eacac51e7b5d6cf775f","distinctID","c8ad9466-ec43-4c53-9022-c536114e89c9","featureFlags",{"_535":40,"_536":67,"_537":14,"_538":40,"_539":14,"_540":40,"_541":542,"_543":40,"_544":40,"_545":40,"_546":40,"_547":14,"_548":40,"_549":40,"_550":40,"_551":40,"_552":40,"_553":67,"_554":40,"_555":556,"_557":558,"_559":14,"_560":40},"resource_addon_default","one_page_connect_workspace_gitlab","cipe_execution_timeline","pylon_chat","new_layout","config_yaml","welcome_view_cnw_experiment","variant-2","workspace_badges","workspace_rewind","automated_add_ons","demo-mode","feature_activation_guide","teams_minimum_spend","show_setup_self_healing_ci_alert","resource_usage_toggle","workspace_sandboxing_toggle","survey-targeting-8e88152ae4-custom","one_page_connect_workspace_github","new_access_control","cnw_empty_workspace_position","treatment","one_page_connect_workspace_manual","test","run_details_polling","non_dte_resource_usage","isProduction","isAnalyticsEnabled","isPosthogEnabled","isPylonEnabled","privateCloud",{"_593":584,"_132":133},"auth0",{"_587":588,"_589":590,"_591":592},"e2eTestMode","rollbar",{"_579":580,"_581":582,"_67":40,"_583":584,"_585":40,"_586":40},"posthog",{"_575":576,"_577":578},{"_523":524},"apiKey","phc_eTmACxF0EKeNRjAZbfpdszbHYumyKhWqsIpMU4Wi53c","apiHost","https://pha-prx.ops.cloud.nx.app","accessToken","d0e4070ed1d54ed29429808f497ffbab3e77f1c74c2a9427fa5c5e418eea62ca96294bc716a7e8210acf93f0d37b6d29","environment","production","codeVersion","2610.14.0002","captureUncaught","captureUnhandledRejections","domain","auth.nx.app","clientId","Ron6k221B4IaH0QK9hmHuCneTovLLPpX","audience","https://api.nrwl.io/","containerVersionTimestamp"]

Merge queue run