chore(deps-dev): bump js-yaml from 4.3.2 to 5.2.2 - #1753
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.2 to 5.2.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.2...5.2.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
njrini99-code
added a commit
that referenced
this pull request
Sep 5, 2026
* chore(scripts): archive 20 verified orphan scripts, narrow the blanket .gitignore rule that hid 13 more Re-verified all 35 files the tooling audit flagged as unreferenced under scripts/ (grep against package.json, .github/, .circleci/, .claude/hooks, vitest.config.ts, docs/ non-archive, and every other script) — 20 are tracked orphans, moved to archive/scripts/ with a two-line provenance header (last-used date, confirmation nothing referenced it). The other 13 (wf_p34*.js, wf_p112_p410.js, baseballhelm-verification.workflow.js) were never committed anywhere and do not exist in this worktree — nothing to delete here. The audit's own "35" count was off by 2 (it counted the table's header and separator rows) — actual orphan-file count is 33, matching "20 tracked + 13 gitignored-and-uncommitted". Replaced .gitignore's blanket `scripts/*.js` with specific patterns for the two scratch-file name shapes it existed to hide. The blanket rule was also silently hiding any future top-level scripts/*.js from git status — exactly the trap quality-gates.md §4 warns about generically, caught here concretely. Verified: npm run guards — 37/37 pass. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(scripts): actually delete the 20 originals the previous commit only half-archived 3e6ba86 created archive/scripts/* with the provenance headers but never committed the deletion of the original scripts/* paths — `git diff --cached --name-only` collapses a detected rename to its destination path only, and the commit's pathspec was built from that output, so the staged deletions of the 20 source paths were silently excluded from the commit and stayed staged. They surfaced again as unstaged "deleted" entries the moment anything touched the index (a `git stash`/`git stash pop` here, while isolating an unrelated typecheck question). Net effect until now: both the original and the archived-with-header copy of all 20 files existed in git history simultaneously. This commit finishes the move — deletes the 20 originals, nothing else. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * chore(deps): apply the 4 open Dependabot npm PRs directly, audit fix, and fix what they broke Applied the exact version bumps from the 4 open npm Dependabot PRs so they become redundant (a 5th, #1755, only touches .github/workflows and is left for the owner to merge as-is): - #1753: js-yaml 4.3.2 -> 5.2.2 (dev) - #1756: dev-dependencies group (@axe-core/playwright, @capacitor/cli, @testing-library/user-event, @vitest/coverage-v8, @vitest/ui, momentic, typescript-eslint) - #1757: production-dependencies group (@ai-sdk/anthropic, @ai-sdk/react, @capacitor/{android,core,ios,local-notifications}, posthog-js, stripe) - #1758: framer-motion 12.42.2 -> 13.1.1 Then `npm audit fix` (no --force). npm audit: 51 vulnerabilities before (1 low/14 moderate/35 high/1 critical) -> 54 after (1/21/31/1). Moderate went up net — audit fix traded some high-severity issues for newly-surfaced moderate ones several levels down the transitive tree; nothing in that delta is reachable from this app (see docs/security/accepted-risks.md for the one alert, #138 extract-zip, with no patched version at all). Fixed three real breakages the bumps caused, each verified by re-running the test that caught it: 1. js-yaml 5 has NO default export (named exports only) — every `import yaml from 'js-yaml'` in this repo (14 files: replay/runners/ manifest.mjs, scripts/contracts/lib/registry.mjs, scripts/flags/lib.mjs, 9 scripts/knowledge/*, scripts/release-intel/score-change.ts) resolved `yaml` to undefined at runtime. Switched all 14 to `import * as yaml from 'js-yaml'`. Also js-yaml 5's `.load()` now types as `unknown` (was `any`) — annotated replay/runners/manifest.mjs's loadManifest() with an explicit JSDoc return type so that doesn't leak into replay-manifest-schema.test.ts's property access. 2. stripe 22.5.0 regenerates its `Stripe.LatestApiVersion` literal type to "2026-07-29.dahlia" (was "2026-06-24.dahlia") — bumped src/lib/stripe/server.ts's pinned STRIPE_API_VERSION to match, per the file's own documented convention ("bump this only alongside an SDK upgrade"). 3. Bumping @ai-sdk/anthropic/@ai-sdk/react transitively pulled `ai` from 7.0.37 to 7.0.79, which narrowed `convertToModelMessages`'s `ignoreIncompleteToolCalls` keep-list to approval-responded/output-available/output-error/output-denied — silently dropping `approval-requested` too. The coach-chat stream route relied on that flag alone to keep an awaiting-coach (Confirm-flow) tool call while dropping a genuinely dangling one; the new SDK behavior would have reintroduced the exact "Tool result is missing" production bug this route already exists to prevent, just for the approval-suspended case. Fixed by having the route pre-filter dangling tool parts itself with the existing `isIncompleteToolPart` predicate (already used for persistence in ui-parts.ts) before calling convertToModelMessages, and dropping the `ignoreIncompleteToolCalls` option entirely — correctness no longer depends on the SDK's internal state list, which just changed under us once already. chat-incomplete-tool-calls.test.ts now pins the SDK's new (undesired) behavior as a documented regression test and adds a second test proving the route's own pre-filter approach is correct; route.test.ts's ui-parts mock gained isIncompleteToolPart so it doesn't resolve undefined. Also fixed one unrelated, pre-existing date-rot test bug surfaced only because real time crossed a threshold while this branch was open: src/lib/admin/database/__tests__/jobs.test.ts hardcoded a fixture `start_time` and let fetchJobsHealth() read the real wall clock (`new Date()`, not injectable) — the fixture aged past the job's 2x-cadence staleness window and started tripping `telemetry_defect`. Pinned the clock with vi.setSystemTime() so it can't happen again. Verified: npm run typecheck, npm run lint, npm test — all exit 0 (1563 test files / 15222 tests passed, 11 skipped). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(security): 20 code-scanning FIX verdicts across sw.js, auth, sanitization, redos, and races Triaged all 42 open CodeQL alerts this wave targeted (24 in src/ + 18 reopened INVESTIGATE items). 20 fixed here; the remaining 22 are DISMISS verdicts recorded in the wave report for the owner to apply on GitHub (false positives and already-neutralized findings, not fixed in code). FIXED: - ios/App/App/public/sw.js (#91, #110): the postMessage handler had no origin check (accepted CACHE_URLS/CLEAR_CACHE from any context that could reach the worker) and a console.warn interpolated an attacker-controlled URL into its own format-string argument. Added an origin check mirroring the fetch handler's existing `self.location.origin` boundary, and moved the URL to a separate console.warn argument. - src/hooks/useAnalyticsTracking.ts (#102, #103): the client analytics session id was seeded from Math.random(). Switched to crypto.getRandomValues. - src/lib/admin/pr-body-parser.ts (#514, #515) and src/lib/baseball/adapters/mini-xml.ts (#459): both stripped HTML/XML comments with a single-pass `<!--...-->/g` replace, which can leave a `<!--` behind — removing one match can concatenate what survives on either side into a NEW match the same global pass never re-scans. Loop each until the string stops changing, per file ('<!<!----' now fully resolves to '' in both). - src/lib/notifications/email.ts (#94, #109): the same single-pass tag-strip gap for a plain-text preview excerpt (now loops; the actual HTML sanitization boundary was already escapeHtml() downstream, so this is defense-in-depth) plus a dead `.replace('-', '-')` no-op removed (js/identity-replacement). - src/lib/coachhelm/v2/mining/lie-specific-analysis.ts (#108): same identity-replacement no-op removed — the digit/hyphen/plus strip alone already produces a key matching DISPERSION_BENCHMARKS.approach. - src/lib/utils/describe-error.ts (#551): the <title> extraction regex ran against the FULL untrusted upstream error-page body with no length cap, and an ambiguous nested quantifier let a run of unclosed `<title` substrings drive quadratic backtracking. Now matches against the already-computed 2000-char `head` instead. - src/lib/utils/schedule-parser.ts (#559): DAYS_INLINE_RE's day-code alternation is genuinely ambiguous (bare "T" matches both `Tu?` and `Th?`; bare "S" matches both `Sa?` and `Su?`), and repeating it unbounded let a long run of ambiguous characters in pasted schedule text drive exponential backtracking. Bounded the repeat to {1,14} — more than any real day code needs, and enough to cap the backtracking search space to a small constant regardless of input length. - src/lib/observability/redact-pii.ts (#584): `rec[k] = ...` inside a `for (const k of Object.keys(rec))` loop can hit `__proto__` — JSON.parse creates a normal own property literally named "__proto__" without triggering the special accessor, but assigning to it later does. Skip __proto__/constructor/prototype explicitly. - src/lib/observability/supabase/incident-memory-writer.ts (#608): an `existsSync` check followed by a plain `writeFileSync` was a TOCTOU race — anything creating the path between the two silently got overwritten. Replaced with a single atomic `writeFileSync(..., { flag: 'wx' })`, catching EEXIST for the same ALREADY_EXISTS result shape. - src/app/auth/callback/route.ts (#112, #113, #114): three console.warn calls logged a rejected `?next=` redirect target verbatim — a value carrying a newline could forge what looks like a separate log line to anyone reading raw log output. Added sanitizeForLog() (strips control characters, caps length) at all three call sites. - scripts/resend-diagnose.mjs (#382, #383) and tools/continuous-improvement/validate_api_key.py (#7): both printed real secret-key material to the terminal (a 4-char prefix; 30 characters from the front+back respectively) for a diagnostic that only needed to confirm presence/length. Dropped the prefix in the JS script; added a proper first4/last4-with-asterisks mask in the Python one. Every FIX with observable behavior added or extended a unit test proving the specific defect (concatenation-created comment marker, ReDoS timing bound, EEXIST race, origin check, masked-key shape, etc.) — 8 new/extended test files, all passing. Verified: npm run typecheck, npm run lint, npm test, npm run guards — all exit 0 (1566 test files / 15244 tests passed, 11 skipped; 37/37 guards). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(setup): replace RUN_ON_YOUR_MACHINE.md's inline password placeholders The two postgresql:// connection strings used a bare <password> token, which the tooling audit read as ambiguous next to a literal leaked value (the file's own history note says a real password WAS committed here once, 2026-05-17, and rotated). Neither line held a real credential — both were already placeholders — but replaced <password> with the more explicit <from .env.local> and added a one-line pointer to where the real value actually lives (the reader's own gitignored .env.local, or the Supabase dashboard), so this can't be misread as a leaked value again. The other four files the audit checked (scripts/apply-migration.sh, archive/misc/sync-remote-to-local.sh, archive/misc/run-audit-psql.sh, docs/archive/2026-01/audits/RLS_AUDIT_REPORT.md) already use a placeholder or a shell-variable indirection with no literal secret — left unchanged per the task's scope. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(qa): finish the visual-audit archival, add the LFS note, fix a path-drift regression Completes the previous commit's docs/qa/baseball-fairway-visual-audit- 2026-07-04/ move — that commit renamed/deleted the tree but left two edits unstaged: - CONTRIBUTING.md: one paragraph noting Git LFS is registered (.gitattributes marks image extensions binary) but nothing routes images through it (git lfs ls-files returns 0 objects), so screenshot packs belong in a PR description, not the tree. - The archived README.md: updated its own directory-structure diagram to note the 108 screenshots + 2 manifest.json sidecars were removed (recoverable from git history), rather than leaving it describing files that no longer sit next to it. - docs/generated/DOCUMENT_AUTHORITY_INVENTORY.md: regenerated (npm run knowledge:doc-inventory) so the AUTOGEN inventory reflects the move instead of drifting. Also fixes a real regression `npm run docs:check` caught: archiving scripts/__tests__/badge-consolidation.test.mjs (this wave's item 1) broke two memory/ledgers/ path references to it — exactly the ledger docs CLAUDE.md routes sessions to read first. Updated both to point at archive/scripts/__tests__/badge-consolidation.test.mjs with a one-line note on when/why it moved, preserving the historical narrative while keeping the path resolvable. `docs:path-drift`: 2 new failures -> 0. Locked in two ratchet improvements this wave's edits produced as a side effect (exported a few previously-private functions for direct unit testing; moved markdown out of ratchet scope by archiving it): lint warnings 62 -> 61, markdown violations 30465 -> 30228. Verified: npm run docs:check (all 5 gates), npm run guards, npm run lint:ratchet, npm run markdown:ratchet, npm run knowledge:globs, npm run lint:duplicate-exports, npm run audit:supabase-errors, npm run audit:fail-open — all exit 0, no regressions. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(coachhelm): document and pin the one gap in the tool-call pre-filter Advisor review of 4933859/f5f32da95 found that our isIncompleteToolPart pre-filter (added to replace the ai 7.0.79-broken ignoreIncompleteToolCalls flag) only drops input-streaming/input-available parts. It does not drop an output-available part carrying preliminary: true — the SDK's shape for a tool result from a still-streaming multi-yield execute (an async generator). convertToModelMessages itself does not special-case preliminary either (the `case "output-error": case "output-available":` branch in node_modules/ai/dist/index.js converts it to a full tool-result regardless), so a preliminary part would flow through unfiltered on either side. Verified this is not reachable today: every execute() in src/lib/coachhelm/v3/chat/agent-tools.ts (buildCoachTools) is a plain async function returning one value, never an async generator, which is the only shape the SDK uses to emit preliminary: true. Documented the assumption in route.ts with an explicit note on what to add if a future tool streams partial output, and added a pinning regression test to chat-incomplete-tool-calls.test.ts so the gap is caught the moment it becomes reachable rather than rediscovered from a production incident. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(baseball): protect CDATA content from the #459 comment/prolog cleanup Advisor review of 4933859 found that the #459 fix (loop-until-stable comment-marker cleanup, to close js/incomplete-multi-character-sanitization) ran before the CDATA unwrap and stripped bare `-->`/`<!--` markers with no regard for whether they sat inside a CDATA section. Per XML, CDATA content is not parsed as markup at all, so a literal `-->` inside `<![CDATA[a --> b]]>` is legal text, not a comment terminator — but the blind document-wide replace could not tell the difference. Verified: `<![CDATA[a --> b]]>` came out of parseXml() as `a b`, silently eating the arrow. A second, pre-existing instance of the same bug class (not introduced by 4933859, not flagged by CodeQL): the prolog/PI strip `/<\?[\s\S]*?\?>/g` is lazy but unanchored to any one processing instruction. Given an unterminated `<?...` earlier in a malformed vendor feed and a `?>` inside a LATER CDATA section, the lazy match used to be satisfied by the CDATA's own `?>`, silently consuming every real element in between as if it were part of the PI. This parser's own docs commit to warning on malformed input rather than corrupting it — GameChanger/StatCrew feeds are external, untrusted data, and this repo's mini-xml.ts is the only parser standing between that data and a coach's stats. Fixed by extracting all CDATA sections into placeholders BEFORE both the prolog/PI strip and the comment-marker cleanup run, restoring them verbatim at the very end. Placeholders are delimited with U+E000 (Private Use Area) — deliberately not a NUL byte, which would trip eslint's no-control-regex and make this file look binary to grep/diff tooling. Added 4 regression tests: the `-->`-in-CDATA and `<!--`-in-CDATA cases, a real-comment-beside-CDATA sanity check, and the unterminated-PI-eating- through-CDATA case. Confirmed each old ordering reproduces its corruption and the new ordering does not. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * chore(docs): drop the now-dead docs/qa PNG gitignore exemption Advisor review of item 5 (this wave's docs/qa visual-audit archival) flagged the .gitignore exemption for docs/qa PNGs as still unscoped, citing docs/audits/COMPLETE_FINDINGS_2026_08_18.md's recommendation. That was already stale: owner commit 32a6ef0 (2026-09-01) had already narrowed it to !docs/qa/baseball-fairway-visual-audit-2026-07-04/**/*.png specifically. But item 5 in this same wave git rm'd every PNG under that exact path and moved its markdown to docs/archive/2026-07/, so the scoped exemption line now names a path with nothing left under it, and its comment still claimed "the existing pack is KEPT" — no longer true. Removed the dead exemption line and rewrote the comment to describe current state: the pack was archived 2026-09-05, docs/qa/ no longer contains the path the old exemption named, and there is nothing left to scope an exemption to. Adding a new pack still means adding its own scoped `!` line, per the existing convention. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * docs(baseball): fix mini-xml's top-of-function comment to match the new order Follow-up to 49e3900: the one-line "Strip BOM, prolog, comments, CDATA-wrap..." summary at the top of parseXml() still described the OLD preprocessing order after CDATA extraction was moved ahead of both the prolog/PI strip and the comment cleanup. Updated it to match, and pointed at the CDATA-extraction comment for the why. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(tools): print the API key's shape, not any of its bytes CodeQL raised #609 on the #7 fix: the mask still printed the first and last four characters, and any substring of a credential is key material once it is in a scrollback or a captured log. The script now prints only the length and whether the value carries the Anthropic prefix, which is what a human needs to confirm they exported the intended key. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * chore(tools): make validate_api_key.py pass the Review Gate's ruff step The gate lints every touched Python file in full, and this file carried three pre-existing findings: a shebang on a non-executable file (now mode 100755) and two blind excepts, which are deliberate in a diagnostic that must report whatever failed — marked as such rather than narrowed. Verified: ruff check reports no findings. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(flags): an empty flags file is no flags, not a parse error under js-yaml 5 The Dependabot bump from js-yaml 4.3.2 to 5.2.2 changed load('') from returning undefined to throwing, which failed flags:check's own test ("empty document parses to an empty array") in CI's Static checks. The parser now short-circuits whitespace-only input before calling load. Verified: npm run flags:check exit 0 (97 pass, 0 fail). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(codeql): make the shapes CodeQL's queries actually recognize Ten CodeQL alerts (#610-#619) survived a prior round of "fixes" because the new code changed WHAT was flagged without changing the SHAPE the query needs to see: - js/incomplete-multi-character-sanitization (#613-#616): the paired <!--...--> regex and the bare-marker cleanup were chained into one do-while loop. CodeQL only recognizes a loop as resolving a flagged regex when nothing else is chained between that replace() call and the before/after comparison closing the loop — so it kept flagging every intermediate link in the chain. Split into three independent do-while loops (paired, bare opener, bare closer) in both src/lib/admin/pr-body-parser.ts's stripHtmlComments and the equivalent block in src/lib/baseball/adapters/mini-xml.ts's parseXml. Verified by hand against the '<!<!----' concatenation case and all existing tests. - js/bad-tag-filter (#611, #612): the paired regex and the bare closer regex both only matched `-->`, not the `--!>` HTML "bogus comment" terminator. Both now accept `--!?>`. - js/log-injection (#617-#619): sanitizeForLog() already stripped \x00-\x1f/\x7f before these three console.warn calls, but CodeQL's sanitizer recognition keys on a `.replace()` matching `\n`/`\r` literally in the same expression that reaches the sink, not a hex character-class range in a helper's body. Chained an explicit `.replace(/\n|\r/g, '')` onto sanitizeForLog(path) at each call site. - js/clear-text-logging (#610): scripts/resend-diagnose.mjs still logged apiKey.length, itself a value derived from the secret. Replaced with a bare "set" / "not set" readout — no property of the key reaches the log. Verified: the three touched test files (pr-body-parser.test.ts, mini-xml.test.ts, callback-log-sanitize.test.ts — 22 tests) all pass, `node --check` on resend-diagnose.mjs passes, `npm run lint` is 0 warnings, `npm run typecheck` is clean. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(docs): regenerate DOCUMENT_AUTHORITY_INVENTORY after merging main The merge of origin/main (#1840, docs/operations/WORKSPACES.md) conflicted in this generated file. I resolved the conflict with `git checkout --ours` and then ran `npm run docs:regen`, which does NOT touch this file at all (scripts/regen-docs.mjs never calls scripts/knowledge/document-inventory.mjs) — so the merge left it stale by one row (WORKSPACES.md missing from the table, UNKNOWN counts off by one) and CI's "Feature knowledge registry" step failed on it. The correct regenerator is `npm run knowledge:doc-inventory` (node scripts/knowledge/document-inventory.mjs). Verified: knowledge:check, docs:check, lint, and typecheck are all clean. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps js-yaml from 4.3.2 to 5.2.2.
Changelog
Sourced from js-yaml's changelog.
... (truncated)
Commits
3c295595.2.2 released3e5240fparser: avoid reparsing flow sequence pair keysbd7ebb2fix: quote flow scalars where a colon precedes a flow indicator (#773)ac16b425.2.1 released4a864e5Deps bump39f3211!!omap: addMapsupport and remove quadratic complexityff17f1eChangelog update8ed15f1deps bump1a562dcFix changelog linkc28ed5e5.2.0 releasedYou can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.