Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 15, 2025

Bumps js-yaml from 4.1.0 to 4.1.1.

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.0 to 4.1.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Nov 15, 2025
@BYK BYK enabled auto-merge (squash) November 15, 2025 23:16
@BYK BYK merged commit 430f42a into master Nov 15, 2025
10 checks passed
@BYK BYK deleted the dependabot/npm_and_yarn/js-yaml-4.1.1 branch November 15, 2025 23:17
BYK pushed a commit that referenced this pull request Nov 24, 2025
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.0 to 4.1.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
BYK added a commit that referenced this pull request Nov 24, 2025
* Refactor changelog generation to use release.yml for categorization

Co-authored-by: burak.kaya <burak.kaya@sentry.io>

* Fix: Handle ENOENT error and improve changelog generation

Co-authored-by: burak.kaya <burak.kaya@sentry.io>

* Refactor: Improve changelog generation tests

Co-authored-by: burak.kaya <burak.kaya@sentry.io>

* Fix failing tests (#625)

* Refactor: Improve changelog generation and mock fs

This commit refactors the changelog generation logic to correctly handle category-level exclusions and improves the mocking of the `fs` module by using `jest.requireActual` for `readFileSync`. It also updates the `gcsAPI` tests to use the mocked `fs.existsSync`.

Co-authored-by: burak.kaya <burak.kaya@sentry.io>

* chore: Remove package-lock.json and regenerate yarn.lock

- Remove npm-generated package-lock.json file
- Regenerate yarn.lock with current dependencies
- Project uses yarn as the package manager

* fix: Resolve all TypeScript compilation and test failures

Fixed multiple TypeScript compilation errors and dependency issues:

**TypeScript Fixes:**
- Fixed github.ts: Changed Promise resolve callback to match expected signature
- Fixed awsLambdaLayerManager.ts:
  - Added Runtime import and cast CompatibleRuntimes to Runtime[]
  - Cast headers to Record<string, string> for fetch compatibility
- Fixed registry.ts: Added explicit RemoteArtifact type to mapLimit callback
- Fixed brew.ts: Added RemoteArtifact import and type annotation

**Configuration Fixes:**
- tsconfig.build.json: Added noImplicitUseStrict: false to override deprecated parent config option
- jest.config.js: Added transformIgnorePatterns for ESM modules (dot-prop, configstore)
- package.json: Pinned dot-prop to ^5.3.0 to avoid ESM-only version 10.x that breaks Jest

**Test Results:**
- All 38 test suites passing ✅
- 369 tests passing, 1 skipped (370 total)
- 28 snapshots passing

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

* Refactor changelog generation to use GitHub PR format

Co-authored-by: burak.kaya <burak.kaya@sentry.io>

* Refactor changelog generation to use Sets for exclusions

Co-authored-by: burak.kaya <burak.kaya@sentry.io>

* Refactor: Normalize release config exclusions to use empty sets

Co-authored-by: burak.kaya <burak.kaya@sentry.io>

* Refactor: Simplify changelog normalization and matching logic

Co-authored-by: burak.kaya <burak.kaya@sentry.io>

* Refactor: Simplify changelog exclusion logic and update yarn.lock

This commit refactors the changelog exclusion logic to be more concise and removes unnecessary checks. It also updates the yarn.lock file to reflect the latest dependency versions.

Co-authored-by: burak.kaya <burak.kaya@sentry.io>

* Checkpoint before follow-up message

Co-authored-by: burak.kaya <burak.kaya@sentry.io>

* Refactor changelog generation and update tsconfig

Co-authored-by: burak.kaya <burak.kaya@sentry.io>

* build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#624)

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.0 to 4.1.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump js-yaml from 3.13.1 to 4.1.1 (#626)

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.13.1 to 4.1.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.13.1...4.1.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: Upgrade sentry/node to latest (#627)

* chore: Upgrade sentry/node to latest

* fix

* fix: Upgrade Jest to 29.7.0 to fix ESM/CJS compatibility with Node 22

The older Jest version had issues with strip-ansi ESM module resolution
when running on Node.js 22. Also added a resolution to pin strip-ansi
in @jest/reporters to the CJS-compatible version.

* fix: Remove corrupted 'yarn' prefix from test file

Rebase artifact left 'yarn' prefix on a line in the test file.

* fix: Replace Set.intersection() with loop for Node 20 compatibility

Set.intersection() is only available in Node 22+. Use a loop to check
for excluded labels instead.

* fix: Strip redundant PR number suffix from PR titles in changelog

When formatting PR entries for the changelog, the PR number like '(#123)'
at the end of the title is now stripped since the PR link is already
included at the end of the entry.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants