mirror of
https://github.com/toeverything/AFFiNE.git
synced 2026-08-01 17:39:55 +08:00
renovate[bot]
fb647b6003
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [js-yaml](https://redirect.github.com/nodeca/js-yaml) | [`^4.2.0` → `^5.0.0`](https://renovatebot.com/diffs/npm/js-yaml/4.3.0/5.2.2) |  |  | --- ### js-yaml: Exponential parsing time in flow collections leads to denial of service [GHSA-pm4m-ph32-ghv5](https://redirect.github.com/advisories/GHSA-pm4m-ph32-ghv5) <details> <summary>More information</summary> #### Details ##### Summary Parsing a small YAML document can take exponential time. An application that calls `load()` or `loadAll()` on untrusted input can be hung by a payload under 200 bytes. ##### Details When an entry in a flow sequence turns out to be a `key: value` pair, the parser rewinds and parses that entry a second time as the key. If the key is itself a nested flow sequence of the same shape, every level is parsed twice, so the total work is O(2^n) in the nesting depth. The default `maxDepth` of 100 does not help, because the time is already unmanageable at about 30 to 40 levels. Root cause, potentially the: `readFlowCollection` in [parser.ts](https://redirect.github.com/nodeca/js-yaml/blob/master/src/parser/parser.ts), the `restoreState` followed by a second `parseNode` further down. ##### PoC ```javascript const yaml = require('js-yaml') const n = 30 yaml.load('[ '.repeat(n) + '1' + ' ]: 0'.repeat(n)) ``` With default options: 22 levels takes about 1 second, 26 levels about 17 seconds, 30 levels over 2 minutes. The input stays under 200 bytes and grows linearly with `n`. ##### Impact Denial of service. A single small request can keep one CPU busy for minutes or longer and blocks the Node event loop, so one request can stall the whole process. No anchors, aliases, merges, tags, or non default options are required, and it reproduces on the default schema. #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` #### References - [https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5](https://redirect.github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5) - [https://github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853](https://redirect.github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853) - [https://github.com/nodeca/js-yaml/releases/tag/5.2.2](https://redirect.github.com/nodeca/js-yaml/releases/tag/5.2.2) - [https://github.com/advisories/GHSA-pm4m-ph32-ghv5](https://redirect.github.com/advisories/GHSA-pm4m-ph32-ghv5) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-pm4m-ph32-ghv5) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>nodeca/js-yaml (js-yaml)</summary> ### [`v5.2.2`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#522---2026-07-24) [Compare Source](https://redirect.github.com/nodeca/js-yaml/compare/5.2.1...5.2.2) ##### Fixed - Quote flow scalars where a colon precedes a flow indicator, [#​773](https://redirect.github.com/nodeca/js-yaml/issues/773). ##### Security - Avoid exponential parsing time for nested flow sequence pairs. ### [`v5.2.1`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#521---2026-07-02) [Compare Source](https://redirect.github.com/nodeca/js-yaml/compare/5.2.0...5.2.1) ##### Fixed - Add `Map` support to !!omap (should work when `realMapTag` used) ##### Security - Remove quadratic complexity from !!omap `addItem`. Regression from v5 (usually not critical, because YAML11\_SCHEMA is not default anymore). ### [`v5.2.0`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#520---2026-06-26) [Compare Source](https://redirect.github.com/nodeca/js-yaml/compare/5.1.0...5.2.0) ##### Added - Added `maxTotalMergeKeys` (10000) loader option to limit the total number of keys processed by YAML merge (`<<`) across one `load()` / `loadAll()` call. - Added `maxAliases` (-1) loader option to limit the number of YAML aliases per document. ##### Removed - `maxMergeSeqLength` replaced with `maxTotalMergeKeys` for limiting YAML merge processing. ##### Fixed - Round-trip of integers with exponential form (>= `1e21`) ### [`v5.1.0`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#510---2026-06-23) [Compare Source](https://redirect.github.com/nodeca/js-yaml/compare/5.0.0...5.1.0) ##### Added - Collection tags can finalize an incrementally populated carrier into a different result value. ##### Changed - \[breaking] `quoteStyle` now selects the preferred quote style; use the restored `forceQuotes` option to force quoting non-key strings. ### [`v5.0.0`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#500---2026-06-20) [Compare Source](https://redirect.github.com/nodeca/js-yaml/compare/4.3.0...5.0.0) ##### Added - Added named exports for schemas, tags, parser events and AST utilities. - Reworked `JSON_SCHEMA` and `CORE_SCHEMA` with spec-compliant scalar resolution rules, and added `YAML11_SCHEMA`. - Added `realMapTag` for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them. - Added `dump()` `transform` option for changing the generated AST before rendering. - Added `dump()` options `seqInlineFirst`, `flowBracketPadding`, `flowSkipCommaSpace`, `flowSkipColonSpace`, `quoteFlowKeys`, `quoteStyle` and `tagBeforeAnchor`. - Added formal data layers (events and AST) for modular data pipelines. - Added low-level parser (to events), presenter and visitor APIs. - Added the [YAML Test Suite](https://redirect.github.com/yaml/yaml-test-suite) to the test set. ##### Changed - See the [migration guide](docs/migrate_v4_to_v5.md) for upgrade notes. - Rewritten in TypeScript and reorganized the public API around flat named exports. - Reduced the set of exported schemas: - YAML 1.2 schemas: `CORE_SCHEMA` (loader default), `JSON_SCHEMA`, `FAILSAFE_SCHEMA`. - `YAML11_SCHEMA`, a combination of all YAML 1.1 tags (YAML 1.1 does not specify a schema, only "types"). - `load`/`dump` default behaviour is now specified exactly via schemas: - `load` uses `CORE_SCHEMA`, without `!!merge` by default. - `dump` uses `YAML11_SCHEMA` + `CORE_SCHEMA` for the quoting check, to guarantee backward compatibility by default. - `!!set` is now loaded as a JavaScript `Set`. - Replaced the `Type` API with a tags API. Similar, but more precise and simpler. See examples for details. Tags can be defined via `defineScalarTag()`, `defineSequenceTag()` and `defineMappingTag()`, or as a spread + override of an existing tag. - Renamed `Schema.extend()` to `Schema.withTags()`. - Expanded YAML 1.2 conformance and improved handling of directives, document markers, block keys, multiline scalars, tag syntax and other things. - `load()` now throws on empty input instead of returning `undefined`. - Moved browser builds to the `js-yaml/browser` export. - Deprecated the `loadAll` signature with an iterator (still works, but is a candidate for removal). ##### Removed - Removed deprecated `safeLoad()`, `safeLoadAll()` and `safeDump()` exports. - Removed `DEFAULT_SCHEMA` and the nested `types` export. - Removed loader options `onWarning`, `legacy` and `listener`. - Removed dumper options `styles`, `replacer`, `noCompatMode`, `condenseFlow`, `quotingType` and `forceQuotes`. Renamed `noArrayIndent` to `seqNoIndent`. Formatting and representation are now configured through presenter options, schemas and tag definitions. See migration guide on how to replace. - Removed support for importing internal files from `lib/`. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJjYW5hcnkiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>