chore: Bump js-yaml from 3.15.1 to 3.15.2 - #250
Conversation
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.15.1 to 3.15.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.15.1...3.15.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM, straightforward dependency bump.
What was reviewed: confirmed the diff is limited to yarn.lock, bumping the transitive js-yaml dependency from 3.15.1 to 3.15.2 (resolution and checksum only); no source files, configs, or direct dependencies were touched. The upstream change is a small patch-level fix (merge-sequence size limit / CPU-DoS mitigation), consistent with the version/checksum delta shown.
Extended reasoning...
Overview
The only changed file is yarn.lock, and the only content change is the version/resolution/checksum bump of the transitive dependency js-yaml from 3.15.1 to 3.15.2 (pulled in via the ^3.13.1 range). No application source code, build configuration, or other lockfile entries were modified.
Security risks
None introduced by this change. The bump is to a patch version of a transitive YAML parsing library, and per the changelog referenced in the PR description it actually hardens against a CPU-DoS vector in merge-key handling, so if anything it is a minor security improvement. There is no code path in this repository being altered.
Level of scrutiny
This warrants minimal scrutiny: it is a single-line, auto-generated lockfile diff produced by Dependabot, mechanical in nature, with no ambiguity or design decisions involved.
Other factors
No bug hunter findings were reported, there are no CODEOWNERS restrictions apparent for a lockfile, and no outstanding review threads or objections exist in the conversation timeline.
1 participant
Bumps js-yaml from 3.15.1 to 3.15.2.
Changelog
Sourced from js-yaml's changelog.
Commits
5c45bd63.15.2 released5a708f9dist rebuild3485bc0Backport merge limits from v5.4.1f34812fUpdate .gitignoreDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.