[mtrezza]

Closes #432

Bumps js-yaml from 4.3.0 to 4.3.2. This is a transitive development dependency (semantic-release → cosmiconfig → js-yaml); only package-lock.json changes. The update resolves the security advisories GHSA-5p4m-2wfm-xmqj (fixed in 4.3.1) and GHSA-2883-xcg3-v3hh / CVE-2026-84375 (fixed in 4.3.2).

cosmiconfig loads js-yaml only to parse YAML config files. In this repository semantic-release resolves its configuration from release.config.js (.releaserc is a directory of changelog templates), so js-yaml is not loaded during the release.

Changes

• 4.3.1: Removed quadratic complexity from !!omap duplicate key detection (security, backport). Duplicate keys are now detected with an own-property lookup instead of a linear array search; which documents are accepted or rejected is unchanged.
• 4.3.2: Merge sequences (<<: [...]) are hard-limited to 100 entries; longer sequences now throw abnormal merge sequence size (backport).
• 4.3.2: Every merged source mapping now costs one extra unit toward maxTotalMergeKeys (default 10000) in addition to its keys, so a mapping with k keys costs k+1 instead of k. This bounds the CPU use of merge sequences made of empty mappings (security, backport, fix: count empty merge sources against maxTotalMergeKeys nodeca/js-yaml#797).

Breaking Changes

None

Code Changes Required

None — the upgrade is a drop-in replacement.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Warning

Review limit reached

The included review limit has been reached and this organization has disabled usage-based review continuation. Wait for reviews to reset or ask a billing admin to change After included review limits.

• Ask an admin to enable usage-based reviews

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Next included review available in 18 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 54 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 3c7b4153-54c2-4237-a7a3-fe031005028b

Commits

Reviewing files that changed from the base of the PR and between 21ce227 and 47933b7.

Files selected for processing: 1

• package-lock.json

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.54%. Comparing base (21ce227) to head (47933b7).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #437   +/-   ##
=======================================
  Coverage   46.54%   46.54%           
=======================================
  Files         106      106           
  Lines        6196     6196           
  Branches      950      950           
=======================================
  Hits         2884     2884           
  Misses       3004     3004           
  Partials      308      308           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.