Skip to content

fix(deps): vuln js-yaml (minor → 4.2.0) #2359

Merged
Drarig29 merged 3 commits into
masterfrom
engraver-auto-version-upgrade/minorpatch/npm/4-1781556597
Jun 24, 2026
Merged

fix(deps): vuln js-yaml (minor → 4.2.0) #2359
Drarig29 merged 3 commits into
masterfrom
engraver-auto-version-upgrade/minorpatch/npm/4-1781556597

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

Summary: Security update — 1 package upgraded (MINOR changes included)

Manifests changed:

  • . (yarn)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
js-yaml 4.1.1 4.2.0 minor Direct 1 MEDIUM

Security Details

ℹ️ Other Vulnerabilities (1)
Package CVE Severity Summary Unsafe Version Fixed In
js-yaml GHSA-h67p-54hq-rp68 MODERATE JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases 4.1.1 4.2.0

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

@datadog-datadog-prod-us1-2

datadog-datadog-prod-us1-2 Bot commented Jun 15, 2026 •
edited by datadog-official Bot
Loading

Copy link
Copy Markdown

Pipelines  Tests

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 2 Pipeline jobs failed

Continuous Integration | Test standalone binary in Alpine   View in Datadog   GitHub Actions

Continuous Integration | Test standalone binary in ARM Alpine   View in Datadog   GitHub Actions

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 6762a1c | Docs | Datadog PR Page | Give us feedback!

@campaigner-prod
campaigner-prod Bot marked this pull request as ready for review June 16, 2026 13:46
@campaigner-prod
campaigner-prod Bot requested a review from a team as a code owner June 16, 2026 13:46
@gh-worker-campaigns-3e9aa4

gh-worker-campaigns-3e9aa4 Bot commented Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Auto-rebase complete

Branch is up to date with master — rebased onto df67891.

Auto-Rebase · Add no-auto-rebase to opt out

@dd-octo-sts-26fcfa
dd-octo-sts-26fcfa Bot force-pushed the engraver-auto-version-upgrade/minorpatch/npm/4-1781556597 branch from 084d3b3 to d63fa9b Compare June 22, 2026 15:28
@dd-octo-sts-6bb5b9
dd-octo-sts-6bb5b9 Bot force-pushed the engraver-auto-version-upgrade/minorpatch/npm/4-1781556597 branch from d63fa9b to 46c71f5 Compare June 22, 2026 16:30
@dd-octo-sts-c33ac5
dd-octo-sts-c33ac5 Bot force-pushed the engraver-auto-version-upgrade/minorpatch/npm/4-1781556597 branch from 46c71f5 to eb394d7 Compare June 22, 2026 17:04
@dd-octo-sts-2c363b
dd-octo-sts-2c363b Bot force-pushed the engraver-auto-version-upgrade/minorpatch/npm/4-1781556597 branch from eb394d7 to b9e8553 Compare June 22, 2026 18:44
@dd-octo-sts-4aefcb
dd-octo-sts-4aefcb Bot force-pushed the engraver-auto-version-upgrade/minorpatch/npm/4-1781556597 branch from b9e8553 to 2698c15 Compare June 22, 2026 19:24
@dd-octo-sts-c33ac5
dd-octo-sts-c33ac5 Bot force-pushed the engraver-auto-version-upgrade/minorpatch/npm/4-1781556597 branch from 49c7360 to 43b04e0 Compare June 22, 2026 21:20
@gh-worker-campaigns-3e9aa4

gh-worker-campaigns-3e9aa4 Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

Auto-rebase failed

Lockfile regeneration failed during rebase onto master. Your branch was not updated. You may need to rebase and regenerate lockfiles manually.

Error details
  • Custom Action: registry.ddbuild.io/images/engraver-custom-action:update-yarn-lockfile ❌ (0.00s) - container exited with non-zero status code: 1:
Error Logs (last 30 lines) 
�D    at IncomingMessage.destroy (node:internal/streams/destroy:84:5)
�@    at TLSSocket.socketCloseListener (node:_http_client:534:11)
�+    at TLSSocket.emit (node:events:531:35)
��    at node:net:346:12
�>➤ YN0001: │ ReadError: The server aborted pending request
�c    at IncomingMessage.<anonymous> (/campaigner/checkout/.yarn/releases/yarn-4.10.3.cjs:146:12029)
�/    at Object.onceWrapper (node:events:633:28)
�1    at IncomingMessage.emit (node:events:519:28)
�N    at c.emit (/campaigner/checkout/.yarn/releases/yarn-4.10.3.cjs:141:22975)
�=    at IncomingMessage._destroy (node:_http_incoming:221:10)
�7    at _destroy (node:internal/streams/destroy:122:10)
�D    at IncomingMessage.destroy (node:internal/streams/destroy:84:5)
�@    at TLSSocket.socketCloseListener (node:_http_client:534:11)
�+    at TLSSocket.emit (node:events:531:35)
��    at node:net:346:12
�>➤ YN0001: │ ReadError: The server aborted pending request
�c    at IncomingMessage.<anonymous> (/campaigner/checkout/.yarn/releases/yarn-4.10.3.cjs:146:12029)
�/    at Object.onceWrapper (node:events:633:28)
�1    at IncomingMessage.emit (node:events:519:28)
�N    at c.emit (/campaigner/checkout/.yarn/releases/yarn-4.10.3.cjs:141:22975)
�=    at IncomingMessage._destroy (node:_http_incoming:221:10)
�7    at _destroy (node:internal/streams/destroy:122:10)
�D    at IncomingMessage.destroy (node:internal/streams/destroy:84:5)
�@    at TLSSocket.socketCloseListener (node:_http_client:534:11)
�+    at TLSSocket.emit (node:events:531:35)
��    at node:net:346:12
�%➤ YN0000: └ Completed in 25s 7ms
�/➤ YN0000: · Failed with errors in 25s 282ms
��Restoring package.json...
��package.json restored

Auto-Rebase · Add no-auto-rebase to opt out

dd-octo-sts-6cbbf8 Bot and others added 2 commits June 23, 2026 14:31
@dd-octo-sts-6cbbf8 @dd-octo-sts-c33ac5
ADMS: vuln js-yaml (minor → 4.2.0)
3b3d1e2 
Co-authored-by: dd-octo-sts-c33ac5[bot] <256648544+dd-octo-sts-c33ac5[bot]@users.noreply.github.com>
@dd-octo-sts-6cbbf8 @dd-octo-sts-c33ac5
trigger ci
78acc05 
Co-authored-by: Ava Silver <[email protected]>

Co-authored-by: dd-octo-sts-c33ac5[bot] <256648544+dd-octo-sts-c33ac5[bot]@users.noreply.github.com>
@gh-worker-campaigns-3e9aa4

gh-worker-campaigns-3e9aa4 Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

Auto-rebase complete

Branch is up to date with master — rebased onto d31db41.

Auto-Rebase · Add no-auto-rebase to opt out

@dd-octo-sts-6cbbf8
dd-octo-sts-6cbbf8 Bot force-pushed the engraver-auto-version-upgrade/minorpatch/npm/4-1781556597 branch from 43b04e0 to 78acc05 Compare June 23, 2026 14:31
@Drarig29
Drarig29 merged commit 5e31905 into master Jun 24, 2026
32 of 34 checks passed
@Drarig29
Drarig29 deleted the engraver-auto-version-upgrade/minorpatch/npm/4-1781556597 branch June 24, 2026 10:37
@ava-silver ava-silver mentioned this pull request Jun 29, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ava-silver ava-silver ava-silver approved these changes

Assignees

No one assigned

Labels

adms-dependency-update adms-medium-severity adms-minor-update adms-mode-all-vulns adms-npm campaigner-automated-change dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ava-silver @Drarig29