Skip to content

Update js-yaml to 4.3.2 [SECURITY] - #2737

Merged
MarcusSorealheis merged 2 commits into
TraceMachina:mainfrom
MarcusSorealheis:fix-vuln-GHSA-52cp-r559-cp3m
Sep 5, 2026
Merged

Update js-yaml to 4.3.2 [SECURITY]#2737
MarcusSorealheis merged 2 commits into
TraceMachina:mainfrom
MarcusSorealheis:fix-vuln-GHSA-52cp-r559-cp3m

Conversation

@MarcusSorealheis

@MarcusSorealheis MarcusSorealheis commented Sep 5, 2026

Copy link
Copy Markdown
Member

What and why

Bumps the transitive js-yaml package from 4.1.1 to 4.3.2 in
web/bun.lock to clear three advisories the OpenSSF Scorecard
vulnerabilities check flags on main, all quadratic-CPU denial of service
in the parser and all fixed by 4.3.1:

js-yaml reaches the tree through fumadocs-core and fumadocs-mdx in
the docs app (frontmatter parsing at build time). Both ranges (^4.1.1)
already allow 4.3.2, so only the lockfile changes.

How was this verified?

  • bun has no command for bumping a single transitive package in place, so
    the bump was done with a temporary overrides entry for js-yaml,
    bun install, removing the override, and bun install again. The diff
    is the single js-yaml entry, and bun install reports no changes
    against the unmodified manifests.
  • bun run build --filter=@nativelink/docs builds the docs app on this
    lockfile: 108/108 static pages, so every MDX frontmatter block in the
    docs still parses.

Risk

Low. Minor releases of a YAML parser that only runs while building the
docs site, on frontmatter this repository authors itself. A regression
would surface as a docs build failure in the web CI job.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE

@MarcusSorealheis @claude
Update js-yaml to 4.3.2 [SECURITY]
6698837 
Fixes GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj and GHSA-h67p-54hq-rp68
(quadratic CPU consumption in merge-key and !!omap handling) in the
js-yaml copy that fumadocs pulls into the docs app. Lockfile-only change.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE
@vercel

vercel Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
nativelink Ready Ready Preview Sep 5, 2026 4:59pm UTC
nativelink-aidm Ready Ready Preview Sep 5, 2026 4:59pm UTC

Request Review

@MarcusSorealheis
MarcusSorealheis merged commit 634214f into TraceMachina:main Sep 5, 2026
11 checks passed
@MarcusSorealheis MarcusSorealheis mentioned this pull request Sep 5, 2026
Merged
modernmedici added a commit to modernmedici/nativelink that referenced this pull request Sep 6, 2026
@modernmedici @MarcusSorealheis
@cursoragent @palfrey @amankrx @claude
web: fix company Media kit Download 404 (#4)
894d3a5 
* Introduce Rules Omniverse (TraceMachina#2720)

* web: point Media kit Download at the shared Drive folder

The company CTA was an incomplete folders/ URL and 404ed. Restore the
folder id from the previous company page so Download opens the kit.

Fixes TRA-548.

Co-authored-by: Sumon Sadhu <sumon.sadhu@gmail.com>

* Cursor/menlo security case study 6c68 (TraceMachina#2721)

* docs: add Menlo Security Chromium case study

Publish the approved external Menlo Security case study on Resources
and style markdown tables in blog article prose so the results grid
renders as a readable before/after comparison.

* docs: use the Menlo Security wordmark on the case study

Host the official site wordmark and point the post's Open Graph image
at it, matching how CIQ and LastMile AI attach a customer logo.

* docs: add Menlo hybrid Kubernetes topology figure

Place the architecture slide under The Architecture so the hybrid
control plane, local CAS, and elastic worker pools are visible next
to the topology they describe.

* docs: add Menlo Chromium build-time comparison figure

Place the 4.5h to 25m lockup under The Results and use it as the
Open Graph image so the social preview carries the same claim.

* docs: enlarge the opening case-study pull quote

Render blockquotes as a large first paragraph with a smaller
attribution line so Christopher Staite's Chromium quote leads the
Menlo article at pull-quote size rather than body type.

* docs: make blog pull quotes a guaranteed larger size

Style the opening quote with explicit CSS on the post page so the
Staite line reads at 1.75–2rem instead of body type, with a smaller
attribution under it.

* docs: redesign blog prose for the Menlo case study

Treat the article as long-form, not default markdown: a spec-sheet
glance list, pull quote with mono attribution, metric table, captioned
figures, and a closing card — using the Technical Warmth type and
color system so the body actually reads.

* docs: make blog list markers clearly brand purple

Default discs were winning the eye on unordered lists. Force
list-style off on items and use a 7px brand dot so Challenge
bullets match the numbered rollout markers.

* docs: point the Menlo case study CTA at enterprise.nativelink.com

The closing get-started link went to app.nativelink.com; send readers
to the enterprise site instead.

* docs: add glance-row icons to the Menlo case study

Put a small brand-tint icon on each At a Glance row so the spec
sheet scans as Industry, Scale, Challenge, Solution, Result, and
Adoption instead of a wall of labels.

* docs: shrink glance icons so the spec sheet columns stay put

Drop the tinted 26px tiles. Keep 11px brand marks in the existing
row padding so Industry–Adoption still line up as before.

* docs: add a Company header with the Menlo wordmark

Lead the At a Glance spec sheet with a Company row so the table
opens as COMPANY plus the Menlo Security logo.

* docs: keep glance icons in-flow and add a Menlo company card

Stop absolutely positioning row icons so they stay aligned with labels
from desktop through phone. Replace the oversized wordmark with a compact
company card: hexagonal mark, Menlo Security name, and menlosecurity.com.

* docs: use the official Menlo wordmark in the company card

Replace the cropped hexagonal O with Menlo Security's actual wordmark,
kept small on a white logo tile. The card still spells out Menlo Security
and links to menlosecurity.com.

* docs: set the Menlo company cell in the glance table

Drop the nested chip and white logo tile so Company reads as another
spec-sheet row: official wordmark, Menlo Security, and the URL using
the same type and colors as the rest of the table.

* docs: add a Company icon and even out glance-table spacing

Give Company the same in-flow label icon as the other spec-sheet rows,
and tighten column gap, label gap, and the wordmark-to-name spacing so
the first cell sits on the same rhythm as Industry through Adoption.

* docs: scale the Menlo wordmark to the glance value stack

* docs: tighten glance-table spacing and keep Company on the same grid

Give Company a building icon like the other labels, top-align the
wordmark lockup, and pull the label column in so icons sit with their
copy instead of floating in a wide gutter.

* docs: give stacked glance rows a little more breathing room

* docs: center figure captions and number them Fig. 1 and Fig. 2

Label the build-time comparison and the hybrid topology with numbered
captions, and center the sentences under each image.

* docs: lock the Menlo wordmark to the name and URL

Size the logo to the two-line type stack and space the name and URL
against the top and bottom of the wordmark so MENLO lines up with
Menlo Security and SECURITY lines up with the link.

* chore: ignore JPEG assets in the marketing site

Stop tracking the Menlo case-study photos and ignore *.jpg under
web/apps/web so those binaries stay local.

* chore: clear pre-commit failures on the Menlo case study

Add a trailing newline to blog-prose CSS, stop tracking marketing
binaries (JPEG and PNG), and fix Vale: keep Staite and Cybersecurity
in the vocab, replace easily/configurability/Uncached in the copy.

* docs: make the Menlo case study read more naturally

Drop em dashes and rewrite the post in a more spoken register, without changing the facts.

* chore: add trailing newline to the Menlo wordmark SVG

The end-of-file-fixer hook requires files to end with a newline.

---------

Co-authored-by: Marcus Eagan <marcuseagan@gmail.com>

* Upgrade rules_rs to 0.0.108 to fix zlib issues (TraceMachina#2724)

* Upgrade to Rust 1.97.1 (TraceMachina#2718)

* Upgrade flake for newer Rust version

* Use upstream cargo-llvm-cov

* Remove unused async in evicting_map

* Fix various sanitizer build issues

* Fix complaint from unused_async_trait_impl

* Lots of new linter issues

* Improve asserts on is_empty

As per https://rust-lang.github.io/rust-clippy/main/index.html#assert_is_empty

* Clarify lib_tests failures

* More version message changes and lint fixes

* More async reductions

* Even more clippy fixes

* Cope with nightly-only lints

* Upgrade scorecard action to 2.4.4 (TraceMachina#2725)

* docs: track Menlo case-study figures under public/assets (TraceMachina#2723)

Move the wordmark and figure paths off /case-studies, stop ignoring
JPEGs on the marketing site, and allow these two figures through
forbid-binary-files so they clone and render.

* Retire queued actions no client is waiting on (TraceMachina#2726)

* Sweep queued actions no client is waiting on

* Only let a client's subscriber write the client keepalive

* Expire the client keepalive key

* Stop a refused update from leaving an empty record behind

* Update Rust crate event-listener to 5.4.2 [SECURITY] (TraceMachina#2731)

* Update Rust crate h2 to 0.4.19 [SECURITY] (TraceMachina#2732)

* Update esbuild to 0.28.2 [SECURITY] (TraceMachina#2736)

Fixes GHSA-g7r4-m6w7-qqqr (arbitrary file read from the esbuild dev
server on Windows, 0.27.3 through 0.28.0) in the esbuild copy that
fumadocs-mdx pulls into the docs app. Lockfile-only change.


Claude-Session: https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* Update nanoid to 3.3.18 [SECURITY] (TraceMachina#2739)

Fixes GHSA-28wg-ghj8-5hjv and GHSA-2v37-7h3g-55p8 (generators looping
indefinitely on negative or zero sizes) in the nanoid copy that postcss
pulls into both web apps. Lockfile-only change.


Claude-Session: https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* Update dompurify to 3.4.14 [SECURITY] (TraceMachina#2735)

* Update js-yaml to 4.3.2 [SECURITY] (TraceMachina#2737)

* Update Next.js to 16.2.12 [SECURITY] (TraceMachina#2733)

* Update mermaid to 11.17.2 [SECURITY] (TraceMachina#2738)

Fixes GHSA-2v8p-3f2j-5mp7, GHSA-3rrr-jr9j-h3q3, GHSA-6x64-9x62-f2gx,
GHSA-c4c3-pg64-4m4v and GHSA-rhh3-jpg6-66xh in the docs app's mermaid
dependency (range ^11.4.1 -> ^11.16.1).


Claude-Session: https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* Update postcss to 8.5.28 [SECURITY] (TraceMachina#2740)

Fixes GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93 and
GHSA-r28c-9q8g-f849 in the postcss copy that @tailwindcss/postcss pulls
into both web apps. Bumps nanoid to 3.3.18 as postcss now requires it.
Lockfile-only change.


Claude-Session: https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Marcus Eagan <marcuseagan@gmail.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Tom Parker-Shemilt <tom@tracemachina.com>
Co-authored-by: Aman Kumar <aman@tracemachina.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@amankrx amankrx amankrx approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@MarcusSorealheis @amankrx