ACT-3722: update js-yaml to 3.15.0

[robertvangor]

Corresponding ticket

• ACT-3722
• Dependabot alert build(deps-dev): bump braces from 3.0.2 to 3.0.3 #62 / GHSA-h67p-54hq-rp68

What changed

• Added a range-scoped npm override that raises vulnerable js-yaml 3.x versions to 3.15.0.
• Refreshed only the single transitive js-yaml lock entry from 3.14.2 to 3.15.0.
• The ancestry remains babel-plugin-istanbul → @istanbuljs/load-nyc-config → js-yaml.

Verification

• npm ci on Node 24
• npm run lint
• npm run test:coverage -- --runInBand: 6 suites / 158 tests passed
• npm run readme: generated documentation remains clean
• npm pack --dry-run --json: package contents validated
• Installed graph contains only js-yaml 3.15.0

A bounded repeated-alias regression used a 33.9 KB YAML document. Version 3.14.2 spent about 3.1 seconds processing the redundant merges, while 3.15.0 rejected the payload in about 33 ms at the maxTotalMergeKeys limit. This dependency is development-only and not shipped in the SDK package, so residual runtime risk is low after merge.

[robertvangor]

Vulnerability validation

• Scope: js-yaml GHSA-h67p-54hq-rp68 transitive development-only remediation
• PR head: 20d90671cdebf8aa830cf9e2ac5ae634c5cf4de8
• Tested head: 20d90671cdebf8aa830cf9e2ac5ae634c5cf4de8
• Tested at: 2026-07-18T18:02:06+02:00

Remediation proof

• GHSA-h67p-54hq-rp68 / CVE-2026-53550 (moderate (CVSS 5.3)): main resolves js-yaml@3.14.2 through babel-jest -> babel-plugin-istanbul -> @istanbuljs/load-nyc-config, affected <3.15.0 -> this head range-scoped override resolves the only copy to js-yaml@3.15.0. baseline npm audit reported the advisory and npm ls showed 3.14.2; exact-head npm ci/npm ls showed only 3.15.0 and targeted audit no longer reported it. A bounded 26.9 KB repeated-alias input completed on isolated 3.14.2 in 904 ms and was rejected by 3.15.0 in 10 ms at maxTotalMergeKeys.

Changelog and compatibility review

• js-yaml 3.14.2 -> 3.15.0: 3.15.0 adds maxTotalMergeKeys with a 10,000 default across YAML merge processing. This deliberately rejects otherwise-valid extremely merge-heavy YAML; maxTotalMergeKeys:-1 is the documented compatibility escape hatch. No engine, peer, ESM/CJS, types, platform, license, or transitive child range change; both versions remain CommonJS/MIT with argparse and esprima unchanged.
• js-yaml advisory <3.15.0 -> 3.15.0: Repeated aliases in YAML merge sequences cause quadratic CPU work. Repository search found no .nycrc YAML or source js-yaml import, so the installed parser path is development-only and presently not fed by repository input; js-yaml is absent from the published SDK artifact.

Test evidence

• PASS [REQUIRED] - baseline and exact head / immutable install, ancestry, and targeted audit: main 2ce315e: js-yaml@3.14.2 and GHSA-h67p-54hq-rp68 present; exact head: npm ci, npm ls js-yaml --all, and audit showed only overridden 3.15.0 and no target advisory. Install left tracked files clean.

• PASS [REQUIRED] - local security regression / bounded repeated-alias merge regression and compatibility boundary: Isolated 3.14.2 completed a 2,000-key x 2,000-alias 26.9 KB payload in 904 ms; exact head 3.15.0 rejected it in 10 ms. Normal merge input and the documented maxTotalMergeKeys:-1 escape hatch both passed on 3.15.0.

• PASS [REQUIRED] - local / lint, coverage, docs, and package: Exact head npm ci; npm run lint; npm run test:coverage -- --runInBand (6 suites, 158 tests, 99.39% statements/lines); npm run readme; npm pack --dry-run all passed.

• PASS [REQUIRED] - CI / supported Node matrix: GitHub Node.js CI passed on Node 20.x, 22.x, and 24.x; policy and both Socket checks also passed on this exact head.

• PASS [REQUIRED] - cumulative local validation / explicit composition with PR ACT-3656: fix @babel/core GHSA-4x5r-pxfx-6jf8 #111: Local merge 3b3266a088a538b0cb91b3028dddc4c667e3059b contains this exact head and PR ACT-3656: fix @babel/core GHSA-4x5r-pxfx-6jf8 #111 as ancestors. npm ci, lint, coverage (158 tests), docs, pack, audit, and serial Node 20.20.2/22.22.3/24.14.0 lint+test lanes passed; composed audit removes both target advisories.

• PASS [REQUIRED] - consumer fixture / packed artifact CommonJS and ESM loading: A disposable consumer installed the exact packed tarball and verified CommonJS require and ESM dynamic import expose helpers, middleware, and sso. Extracted dist, docs, and README payload files were byte-identical to main; js-yaml is not shipped.

• FAIL [NOT-CANDIDATE] - local harness / initial baseline-probe path selection: An initial assertion accidentally loaded patched js-yaml from the local cumulative merge rather than baseline and therefore rejected the payload as expected. The corrected isolated 3.14.2 baseline run passed in 904 ms.

• Deployment: NOT-APPLICABLE (library): plugins-sdk-nodejs is an npm package with no Staffbase dev deployment path; package/consumer validation is the repository-matrix alternative.

• Environment validation: PASS (consumer-fixture, disposable local npm consumer): Exact packed candidate installed cleanly with no consumer audit findings and passed CommonJS and ESM import smoke checks.

• Observability: NOT-APPLICABLE: No service or tenant deployment exists for this package-only repository.; soak: not required; development-only transitive dependency update

• Cleanup: PASS: All local tarballs, consumer fixtures, source-map sentinels, baseline fixtures, PR-fetch clone, and cumulative clone were moved to Trash after verification.

Remaining gaps

• No dev deployment, browser, Grafana, or soak applies to this package-only, development-only dependency remediation.
• No repository .nycrc YAML exists to exercise @istanbuljs/load-nyc-config's YAML loader; the direct parser regression covers the advisory and normal repository test coverage remains clean.
• The remote PR remains a draft and review-required; validation does not change that GitHub state.

Scores and recommendation

• Importance: 4/10 - Moderate algorithmic CPU DoS advisory, but the only installed path is transitive test tooling, no current repository YAML config reaches it, and it is absent from published runtime artifacts.
• Tested residual risk: 2/10 - Exact-head and cumulative remediation proof, direct bounded advisory regression with compatibility controls, full local lanes, green Node 20/22/24 CI, supported-node cumulative lanes, and packed-consumer checks are clean. The recorded harness miss is directly attributed to a patched local merge and was corrected.
• Recommendation: Ready for review and merge; keep the range-scoped override until the upstream parent can be safely upgraded.