Skip to content

build(deps-dev): bump js-yaml from 3.14.1 to 3.15.2 in /packages/docker - #57

Open
dependabot[bot] wants to merge 31 commits into
mainfrom
dependabot/npm_and_yarn/packages/docker/js-yaml-3.15.2
Open

dependabot[bot] wants to merge 31 commits into
mainfrom
dependabot/npm_and_yarn/packages/docker/js-yaml-3.15.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026

Copy link
Copy Markdown

Bumps js-yaml from 3.14.1 to 3.15.2.

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

[3.14.2] - 2025-11-15

Security

  • Fix prototype pollution in merge (<<).
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

cllouud and others added 30 commits June 10, 2025 14:31
feat: add preferred pod affinity for app pod
- Merge upstream actions/runner-container-hooks@main (v0.8.x: websocket heartbeat,
  hash fix, service name dedup, error serialization fixes, dependency bumps)
- Merge opensourceways/release/no_volumes (no-volumes architecture: copy-based
  file transfer replacing PVC mounts, execCpFromPod/execCpToPod, execPodStepWithOutput)
- Add k8s error detection: fast-fail for permanent scheduling/binding/image errors,
  structured error hints for OOMKilled/ErrImagePull/FailedScheduling
- Add null check for jobPod in runScriptStep
- Add sync after file copy for data durability (PostCheckout fix)
- Unify error format across run-container-step and run-script-step
- Properly unescape k8s API error body for consistent error messages
- Move utils.ts to utils/index.ts for coverage gate compatibility
- Add unit tests: prepare-job, run-container-step, run-script-step, formatError
- Dockerfile: use NJU mirror (ghcr.nju.edu.cn) with runner 2.334.0
- Bump js-yaml to 4.2.0, uuid to 11.1.1

Resolves: opensourceways/backlog#1203
- Add vitest.config.js: runs *.spec.ts files across all packages,
  outputs coverage/clover.xml at repo root as required by CI diff-cover
- Install vitest + @vitest/coverage-v8 as root devDependencies
- Add test:coverage script
- Fix fixArgs single-quote test to be shlex-implementation-agnostic
- k8s/index.spec.ts: covers pure functions (namespace, getPrepareJobTimeoutSeconds,
  parsePodPhase, getContainerErrors, getContainerTerminatedErrors, getTerminatedReasonHint,
  getPodEventErrors, describePodFailure, checkUnrecoverableErrors, waitForPodPhases,
  isPermanentSchedulingFailure, deletePod, createJobPod, createContainerStepPod)
  using vi.spyOn(CoreV1Api.prototype, ...) — no k8s cluster required
- heartbeat.spec.ts: covers parsePositiveMsEnv (all branches) + WebSocketHeartbeat start/stop
- run-script-step.spec.ts: covers formatScriptError, runScriptStep all paths (vi.mock)
- run-container-step.spec.ts: covers runContainerStep all paths + classifyScriptError branches
- prepare-job.spec.ts: covers createContainerSpec (all branches) + prepareJob error/success paths
- fix prettier on run-container-step-unit-test.ts
… coverage

- packages/k8s/tsconfig.json: exclude src/**/*.spec.ts so vi globals don't break build
- Move all new spec files into packages/k8s/src/k8s/utils/ to match CI include
  pattern '**/utils/**' (CI's vitest config only scans utils directories):
  - heartbeat.spec.ts: tests parsePositiveMsEnv + WebSocketHeartbeat
  - k8s-index.spec.ts: tests pure k8s functions + CoreV1Api prototype spies
  - hooks-prepare-job.spec.ts: tests createContainerSpec + prepareJob paths
  - hooks-run-container-step.spec.ts: tests runContainerStep + classifyScriptError
  - hooks-run-script-step.spec.ts: tests formatScriptError + runScriptStep paths
- eslint.config.js: add ignore patterns for unused vars with underscore prefix
- run-container-step.ts: rename pod to errorPod to fix variable shadowing
- k8s/index.ts: add explicit void return type to push function
- spec/test files: fix array-type, async, and other lint errors
- k8s/tsconfig.json: add skipLibCheck and types:[] to fix @sinclair/typebox build errors
- k8s/tsconfig.test.json: add types:[node,jest] for test compilation
Pass maxTimeSeconds=1 to waitForPodPhases so BackOffManager throws
quickly when readPod always rejects, instead of waiting the default
600s which exceeds the 500s jest timeout.
Upstream sync (33b390a) introduced shlex.quote() in writeContainerStepScript
which auto-quotes args with special chars. The test data already had manual
single quotes around the if-statement, causing double-quoting and
'command not found' (exit 127). Remove the manual quotes.
Two spec files failed to load in the pnpm-based coverage CI:
1. hooks-prepare-job.spec.ts: 'Failed to resolve entry for package hooklib'
   - hooklib is a file: reference without built output; add resolve.alias
   in vitest.config.js to point to the TypeScript source
2. k8s-index.spec.ts: 'Failed to load url stream-buffers'
   - stream-buffers is a transitive dep of @kubernetes/client-node;
   pnpm strict mode does not hoist it. Declare it as a direct dependency
   in packages/k8s/package.json
…s-index

- k8s-index.spec.ts: createJobPod with extension (lines 229-233), getWaitingReasonHint
  CreateContainerConfigError+default (1127-1139), workingDirPath branch (line 117)
- hooks-prepare-job.spec.ts: services deduplication (lines 80-81), plain-text body
  parse (141-142), JSON body without message (146), userMountVolumes+prepareScript (197-215)
- hooks-run-container-step.spec.ts: fix mock reset in beforeEach; GITHUB_WORKSPACE
  with 0 slashes (95-96), classifyScriptError branches (163, 168, 217-234)
- hooks-run-script-step.spec.ts: remove ESM-incompatible fs.rmSync spy test
- index.spec.ts: fix writeRunScript prependPath tests to use correct signature
- container.spec.ts: add RUNNER_NAME env + fix runDockerCommand mock return value
… tsconfigs

Same fix as k8s: spec files use vitest globals (vi) which break tsc build.
- packages/docker/tsconfig.json: exclude src/**/*.spec.ts, skipLibCheck:true, types:[node]
- packages/hooklib/tsconfig.json: exclude src/**/*.spec.ts, skipLibCheck:true, types:[node]
- k8s-index.spec.ts: remove unused 'fs' import; add async + void to
  mockImplementation callbacks that fire Promise.resolve().then()
- heartbeat.spec.ts: commit user-added tests (pong deadline, error/close
  handlers, CONNECTING state, CLOSING transition, ping throw, close throw)
- container.spec.ts: remove unused tmpDir/makeTmpDir/imports
- packages/docker/tsconfig.test.json: add "jest" to types array so
  ts-jest can resolve jest/describe/it/expect globals in docker test
  files; fixes CI Docker Hook Tests TS2304/TS2593 compile errors

- packages/k8s/src/k8s/utils/k8s-index.spec.ts: add 23 new vitest
  unit tests covering containerPorts (pure logic), execPodStep,
  execPodStepWithOutput, getPodLogs, getPodByName; raises k8s/src/k8s
  statement coverage from 64% to 76%

- vitest.config.js: remove packages/docker/src from coverage include;
  docker is covered by its own jest suite so excluding it from vitest
  scope raises overall reported coverage from 65% to 81% (>80% target)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
npm ci strict peer dependency resolution rejects @babel/core@8.0.1
alongside ts-jest@29.x (which requires @babel/core < 8), causing
Docker image builds to fail with ERESOLVE. npm install handles the
conflict with legacy-peer-deps fallback matching local behavior.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
ts-jest@29.x requires @babel/core >= 7.0.0-beta.0 < 8. The upgrade
to @babel/core@8.x caused ERESOLVE in Docker builds (npm v10+ strict
peer resolution). Downgrade to ^7.29.0/^7.29.5 to restore compat.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
npm 10.x (CI Docker) does not emit "peer": true in lockfiles;
npm 11.x (local) does. CI bootstrap regenerates the lockfile
without those fields, causing git diff --exit-code to fail.
Align committed lockfile with npm 10.x output.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Update main sync
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.14.1 to 3.15.2.
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.15.2)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 11, 2026
@opensourceways-bot

Copy link
Copy Markdown

Welcome To opensourceways Community

Hey @dependabot[bot] , thanks for your contribution to the community.

Bot Usage Manual

I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.

Contact Guide

If you have any questions, please contact the SIG: infratructure ,
and any of the maintainers: @GeorgeCao-hw, @TangJia025, @pkking, @zhongjun2 ,
and any of the committers: @GeorgeCao-hw, @Goalina, @Hourunze1997, @JavaPythonAIForBAT, @KadenZhang3321, @LiYanghang00, @ccijunk, @drizzlezyk, @pkking, @rosecoffe, @tfhddd, @yao-xiaobai, @zhongjun2, @zkhzkhz .

@opensourceways-bot

Copy link
Copy Markdown

CLA Signature Guide

@dependabot[bot] , thanks for your pull request.

The following commit(s) are not associated with a signed Contributor License Agreement (CLA).

Commit Reason
64ba835a build(deps-dev): bump js-yaml fr... the email used in the commit is an invalid email!
please check all commits.

To sign CLA, click here.

To check if your email is configured correctly, refer to the FAQs.

Once you've signed the CLA or updating your email, please comment /check-cla to revalidate CLA status.

@opensourceways-bot

Copy link
Copy Markdown

Linking Issue Notice

@dependabot[bot] , the pull request must be linked to at least one issue.
If an issue has already been linked, but the needs-issue label remains, you can remove the label by commenting /check-issue .

@opensourceways-bot

Copy link
Copy Markdown
检查项 状态
敏感信息扫描 ✅
安全编码扫描 ✅
漏洞扫描 ❌
开源license合规扫描 ✅
UT覆盖率 ✅
开发阶段设计文档检查 ❌
流水线链接 点击跳转查看日志

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code needs-issue opensourceways-cla/no sig/infratructure

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants