chore(deps)(deps): bump js-yaml from 4.1.1 to 5.2.2 - #85
Conversation
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 5.2.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...5.2.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit c69e7ae. Configure here.
| "ioredis": "^5", | ||
| "isomorphic-git": "^1.38.9", | ||
| "js-yaml": "^4.1.1", | ||
| "js-yaml": "^5.2.2", |
There was a problem hiding this comment.
js-yaml v5 breaks default imports
High Severity
Bumping js-yaml to v5 without updating call sites breaks this ESM package. v5 only exposes named exports and no longer provides a default export, so every import yaml from "js-yaml" fails at load time with a missing default export error. That takes down semantic model read/write, publish, agent YAML validation, and the view-query migration. @types/js-yaml remains on v4, which can hide the break from typechecking.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit c69e7ae. Configure here.
There was a problem hiding this comment.
Threat surface review — PR #85 (js-yaml 4.1.1 → 5.2.2)
Dependency-only change (root / apps/api / packages/core + lockfile). No edits to MCP routes, DuckDB sandboxing, Better Auth, Zod handlers, or env/secret handling.
Surfaces checked
| Surface | Result |
|---|---|
| 1. MCP endpoint auth | Not touched |
| 2. Query execution sandboxing | Not touched |
| 3. Admin auth (Better Auth) | Not touched |
| 4. API input validation (Zod) | Not touched |
| 5. Environment secrets | Not touched; no secrets in diff |
| 6. Dependency exposure | Issues found (see below) |
Findings
1. Major bump breaks ESM default imports — fails closed on YAML validation paths
js-yaml@5 intentionally has no default export. This repo is "type": "module" and still uses import yaml from "js-yaml" in:
packages/core/src/services/agent-filesystem.tspackages/core/src/services/semantic-model-files.tspackages/core/src/services/publish.tspackages/core/src/services/semantic-model-schema.tsapps/api/src/scripts/migrate-view-query.ts(+ tests)
Verified on this PR’s lockfile: Node ESM / tsx throw does not provide an export named 'default'. Vitest then hits Cannot read properties of undefined (reading 'load'|'dump'|'YAMLException') in agent filesystem + semantic-model tests.
Risk: Agent YAML syntax validation (ValidatingFilesystemBackend.write / edit) and semantic-model load/dump become unloadable or throw TypeErrors instead of controlled YAML errors. That is an availability / integrity regression on a security-relevant validation gate.
Fix (pick one):
- Prefer
js-yaml@^4.3.0(not 5.x) to clear current 4.1.1 advisories without an API migration:- GHSA-52cp-r559-cp3m (high) — fixed in 4.3.0
- GHSA-h67p-54hq-rp68 (medium) — fixed in 4.2.0+
- Or keep 5.2.2 only after migrating every call site to
import * as yaml from "js-yaml"/ named{ load, dump, YAMLException }, removing obsolete@types/js-yaml@^4.0.9(v5 ships its own types), and re-running the agent + semantic-model test suites.
Note: GHSA-pm4m-ph32-ghv5 (the 5.2.2 headline fix) only affects >=5.0.0, <=5.2.1. It does not justify jumping from 4.1.1 to 5.x by itself.
2. Untrusted yaml.load still lacks DoS limits (pre-existing; relevant if taking 5.x)
packages/core/src/services/agent-filesystem.ts (~139, ~170) calls yaml.load(content) on agent-written YAML with no input-size cap and no maxAliases (v5 default is -1 / unlimited). Merge/alias DoS is exactly what the 4.x advisories above describe, and v5’s own safety docs recommend limits for untrusted input.
Fix: When parsing agent/user YAML, pass e.g. { maxAliases: 100 } (and enforce a max byte length before load).
Out of scope / not introduced here
pnpm audit --prod still reports high findings via markitdown-ts → xlsx / @xmldom/xmldom. Pre-existing; unchanged by this PR.
Verdict: Do not merge as-is. Either retarget to 4.3.0, or complete the v5 import migration (+ loader limits) in the same change.
Sent by Cursor Automation: archmax Security Review
| "ioredis": "^5", | ||
| "isomorphic-git": "^1.38.9", | ||
| "js-yaml": "^4.1.1", | ||
| "js-yaml": "^5.2.2", |
There was a problem hiding this comment.
Dependency exposure / availability: Bumping to js-yaml@^5.2.2 without an import migration breaks this package.
packages/core is "type": "module" and call sites still use import yaml from "js-yaml" (e.g. agent-filesystem.ts, semantic-model-files.ts). v5 has no ESM default export, so Node/tsx fail with does not provide an export named 'default', and Vitest then sees yaml as undefined (load / YAMLException).
That disables the agent YAML validation gate and semantic-model YAML I/O.
Concrete fix: Prefer "js-yaml": "^4.3.0" to pick up GHSA-52cp-r559-cp3m / GHSA-h67p-54hq-rp68 without the breaking change. If staying on 5.2.2, migrate all imports to import * as yaml from "js-yaml" (or named exports), drop @types/js-yaml@4 (line 31 — v5 ships types), and add { maxAliases: … } on untrusted load() in agent-filesystem.ts.
| "dotenv": "^17.4.2", | ||
| "hono": "^4.12.31", | ||
| "js-yaml": "^4.1.1", | ||
| "js-yaml": "^5.2.2", |
There was a problem hiding this comment.
Same break on the API side: apps/api runs via node --import tsx as ESM, and both direct scripts (migrate-view-query.ts) and @archmax/core services default-import js-yaml.
Verified with this lockfile: import yaml from "js-yaml" under tsx throws at module load.
Do not ship 5.x here until imports are migrated, or pin ^4.3.0 instead.
Docker image readydocker pull ghcr.io/archmaxai/archmax:pr-85 |
Bumps js-yaml from 4.1.1 to 5.2.2.
Changelog
Sourced from js-yaml's changelog.
... (truncated)
Commits
3c295595.2.2 released3e5240fparser: avoid reparsing flow sequence pair keysbd7ebb2fix: quote flow scalars where a colon precedes a flow indicator (#773)ac16b425.2.1 released4a864e5Deps bump39f3211!!omap: addMapsupport and remove quadratic complexityff17f1eChangelog update8ed15f1deps bump1a562dcFix changelog linkc28ed5e5.2.0 releasedDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Medium Risk
Major-version YAML parse/dump behavior can change round-trips and quoting; impact is moderate because usage is concentrated in semantic-model file paths rather than auth or payments.
Overview
Bumps
js-yamlto ^5.2.2 in the root workspace,apps/api, andpackages/core, with the lockfile updated to resolve 5.2.2 (and drops direct 4.1.1 / 4.2.0 entries where those were pinned).This is a major dependency upgrade for code that loads and dumps semantic-model YAML (e.g.
semantic-model-files,publish, migration scripts, agent filesystem validation). The release line adds loader limits (maxTotalMergeKeys,maxAliases) and security fixes for merge/alias and nested flow-sequence parsing; v5 also includes breaking dump behavior aroundquoteStylevsforceQuotes.@types/js-yamlis unchanged at ^4.0.9—worth a quick typecheck pass after merge.Reviewed by Cursor Bugbot for commit c69e7ae. Bugbot is set up for automated code reviews on this repo. Configure here.