Replace js-yaml with ad-hoc implementation#1764
Replace js-yaml with ad-hoc implementation#1764marcalexiei wants to merge 3 commits intochangesets:mainfrom
js-yaml with ad-hoc implementation#1764Conversation
🦋 Changeset detectedLatest commit: 7465634 The changes in this PR will be included in the next version bump. This PR includes changesets to release 5 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1764 +/- ##
==========================================
+ Coverage 81.05% 81.16% +0.11%
==========================================
Files 54 54
Lines 2264 2267 +3
Branches 679 682 +3
==========================================
+ Hits 1835 1840 +5
+ Misses 424 422 -2
Partials 5 5 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
d810668 to
8c366d0
Compare
|
For now, I'd prefer to update the dependency instead to avoid some unexpected weird breaks. |
|
If so, we can move this change to |
|
I'm opening a new PR on main with |
|
Since this PR will validate the line, it'll also fix #1301. Unless we do the validation manually with js-yaml if we wanted to, depends on how we draw the line for breaking changes. |
|
I have opened #1772 which implements
Let me know if you wish to proceed with this. |
|
superseded by #1772 re next branch - in general, I'm in favor of parsing using an actual parser. I've seen too many issues coming from regexes that were supposed to be "good enough". This is quite simple parsing... so I'm on the fence. For the time being... we don't need something as robust as |
|
For me I'm fine with this loose regex approach. We can always make it strict if we find people hitting issues, or we need more flexibility down the road. At the moment I don't think it's worth investing in writing a compliant parser until we need it. |
js-yamlPrototype Pollution (CVE) used via@changesets/*Dependencies #1762#1762 (comment)
I implemented a simple parsing logic using Regexp.
Let me know if you prefer to stick with
js-yaml, upgrading to v4 should not be a problem.