Skip to content

fix(deps): Bump js-yaml to 3.15.0#6414

Merged
antonis merged 1 commit into
mainfrom
fix/js-yaml-cve-2026-53550
Jul 7, 2026
Merged

fix(deps): Bump js-yaml to 3.15.0#6414
antonis merged 1 commit into
mainfrom
fix/js-yaml-cve-2026-53550

Conversation

@antonis

@antonis antonis commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

📢 Type of change

  • Bugfix
  • New feature
  • Enhancement
  • Refactoring

📜 Description

Bumps the js-yaml resolutions for the 3.x consumers from ^3.14.2 to ^3.15.0

💡 Motivation and Context

Resolves Dependabot alert #582

💚 How did you test it?

CI

📝 Checklist

  • I added tests to verify changes.
  • No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
  • I updated the docs if needed.
  • I updated the wizard if needed.
  • All tests passing.
  • Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.
  • No breaking changes.

🔮 Next steps)

@antonis @claude
fix(deps): Bump dev-only js-yaml to 3.15.0 (CVE-2026-53550)
5dc670e 
The 3.x copies of js-yaml (pulled transitively by dev tooling such as
nyc, cosmiconfig, front-matter and @yarnpkg/parsers) were pinned to
^3.14.2, which is affected by CVE-2026-53550 (quadratic-complexity DoS
in merge-key handling). Bump the resolutions to ^3.15.0, the backported
patch on the 3.x line — an in-range, semver-compatible upgrade. The 4.x
copies were already on the patched 4.2.0.

js-yaml is dev/build-tooling only and is not a runtime dependency of the
shipped SDK (packages/core), so there is no end-user exposure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

  • fix(deps): Bump js-yaml to 3.15.0 by antonis in #6414
  • feat(tracing): Add extend app start API for standalone app start by antonis in #6392
  • fix(ios): Skip source maps upload on Debug builds by antonis in #6405
  • fix(ci): Bump codeql-action/init to v4.36.3 to match analyze/autobuild by antonis in #6410
  • Revert "feat(ios): Default to consuming sentry-cocoa as an xcframework" (feat(ios): Default to consuming sentry-cocoa as an xcframework #6381) by alwx in #6412

🤖 This preview updates automatically when you update the PR.

@antonis antonis added the ready-to-merge Triggers the full CI test suite label Jul 7, 2026
@antonis antonis changed the title fix(deps): Bump dev-only js-yaml to 3.15.0 (CVE-2026-53550) fix(deps): Bump js-yaml to 3.15.0 Jul 7, 2026
@antonis antonis marked this pull request as ready for review July 7, 2026 07:50
@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Android (legacy) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 459.35 ms 546.40 ms 87.05 ms
Size 49.74 MiB 55.09 MiB 5.35 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
eb93136+dirty 416.18 ms 467.32 ms 51.14 ms
ae37560+dirty 470.40 ms 564.12 ms 93.72 ms
5b7e8a7+dirty 418.55 ms 488.46 ms 69.91 ms
c823bb5+dirty 409.87 ms 478.57 ms 68.70 ms
3817909+dirty 406.67 ms 416.58 ms 9.91 ms
bc0d8cf+dirty 412.37 ms 466.26 ms 53.89 ms
5a23c47+dirty 423.85 ms 466.47 ms 42.62 ms
0a147b2+dirty 464.71 ms 538.81 ms 74.09 ms
a50b33d+dirty 500.81 ms 532.11 ms 31.30 ms
7887847+dirty 416.61 ms 462.04 ms 45.43 ms

App size

Revision Plain With Sentry Diff
eb93136+dirty 48.30 MiB 53.58 MiB 5.28 MiB
ae37560+dirty 48.30 MiB 53.60 MiB 5.29 MiB
5b7e8a7+dirty 48.30 MiB 53.58 MiB 5.28 MiB
c823bb5+dirty 48.30 MiB 53.58 MiB 5.28 MiB
3817909+dirty 43.75 MiB 48.08 MiB 4.33 MiB
bc0d8cf+dirty 48.30 MiB 53.48 MiB 5.18 MiB
5a23c47+dirty 49.74 MiB 54.82 MiB 5.07 MiB
0a147b2+dirty 49.74 MiB 55.08 MiB 5.34 MiB
a50b33d+dirty 43.75 MiB 48.08 MiB 4.33 MiB
7887847+dirty 49.74 MiB 54.81 MiB 5.07 MiB

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

iOS (legacy) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 3828.47 ms 1221.45 ms -2607.02 ms
Size 4.98 MiB 6.51 MiB 1.54 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
d0e3b3e+dirty 3854.77 ms 1218.58 ms -2636.19 ms
5125c43+dirty 3846.45 ms 1221.12 ms -2625.32 ms
580fb5c+dirty 3836.13 ms 1218.72 ms -2617.41 ms
7887847+dirty 3849.83 ms 1227.35 ms -2622.48 ms
a216cb9+dirty 3839.33 ms 1225.26 ms -2614.07 ms
40c9884+dirty 3837.72 ms 1226.61 ms -2611.11 ms
a5d243c+dirty 3842.35 ms 1214.29 ms -2628.06 ms
f170ec3+dirty 3822.26 ms 1218.33 ms -2603.93 ms
68672fc+dirty 3841.58 ms 1228.89 ms -2612.69 ms
ae37560+dirty 3832.10 ms 1219.09 ms -2613.02 ms

App size

Revision Plain With Sentry Diff
d0e3b3e+dirty 4.98 MiB 6.51 MiB 1.53 MiB
5125c43+dirty 5.15 MiB 6.68 MiB 1.53 MiB
580fb5c+dirty 4.98 MiB 6.46 MiB 1.48 MiB
7887847+dirty 4.98 MiB 6.46 MiB 1.48 MiB
a216cb9+dirty 4.98 MiB 6.51 MiB 1.53 MiB
40c9884+dirty 4.98 MiB 6.51 MiB 1.53 MiB
a5d243c+dirty 5.15 MiB 6.68 MiB 1.53 MiB
f170ec3+dirty 5.15 MiB 6.69 MiB 1.53 MiB
68672fc+dirty 5.15 MiB 6.71 MiB 1.55 MiB
ae37560+dirty 5.15 MiB 6.70 MiB 1.54 MiB

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

iOS (new) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 3845.42 ms 1222.04 ms -2623.38 ms
Size 4.98 MiB 6.51 MiB 1.54 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
580fb5c+dirty 3835.45 ms 1218.61 ms -2616.84 ms
d0e3b3e+dirty 3846.64 ms 1226.27 ms -2620.38 ms
a216cb9+dirty 3853.25 ms 1224.77 ms -2628.48 ms
37a2091+dirty 3865.27 ms 1223.92 ms -2641.35 ms
40c9884+dirty 3826.11 ms 1217.04 ms -2609.07 ms
4e0ba9c+dirty 3856.39 ms 1234.44 ms -2621.95 ms
0b5a379+dirty 3857.69 ms 1230.34 ms -2627.35 ms
68672fc+dirty 3832.22 ms 1228.29 ms -2603.93 ms
2c735cc+dirty 1223.33 ms 1224.38 ms 1.04 ms
6acdf1d+dirty 3835.35 ms 1218.30 ms -2617.06 ms

App size

Revision Plain With Sentry Diff
580fb5c+dirty 4.98 MiB 6.46 MiB 1.48 MiB
d0e3b3e+dirty 4.98 MiB 6.51 MiB 1.53 MiB
a216cb9+dirty 4.98 MiB 6.51 MiB 1.53 MiB
37a2091+dirty 5.15 MiB 6.70 MiB 1.54 MiB
40c9884+dirty 4.98 MiB 6.51 MiB 1.53 MiB
4e0ba9c+dirty 5.15 MiB 6.67 MiB 1.51 MiB
0b5a379+dirty 5.15 MiB 6.70 MiB 1.54 MiB
68672fc+dirty 5.15 MiB 6.71 MiB 1.55 MiB
2c735cc+dirty 3.38 MiB 4.74 MiB 1.35 MiB
6acdf1d+dirty 4.98 MiB 6.51 MiB 1.53 MiB

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Android (new) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 428.92 ms 490.94 ms 62.02 ms
Size 49.74 MiB 55.09 MiB 5.35 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
1122a96+dirty 510.16 ms 542.00 ms 31.84 ms
7ac3378+dirty 410.67 ms 442.60 ms 31.92 ms
b04af96+dirty 430.33 ms 485.98 ms 55.65 ms
3817909+dirty 357.52 ms 391.52 ms 34.00 ms
20fbd51+dirty 594.38 ms 655.35 ms 60.97 ms
0a147b2+dirty 442.80 ms 522.24 ms 79.44 ms
a5d243c+dirty 499.20 ms 525.62 ms 26.42 ms
2363c0f+dirty 419.48 ms 463.92 ms 44.44 ms
5257d80+dirty 472.37 ms 494.54 ms 22.17 ms
0a9e622+dirty 425.22 ms 457.00 ms 31.78 ms

App size

Revision Plain With Sentry Diff
1122a96+dirty 48.30 MiB 53.54 MiB 5.24 MiB
7ac3378+dirty 43.94 MiB 48.99 MiB 5.05 MiB
b04af96+dirty 49.74 MiB 55.00 MiB 5.26 MiB
3817909+dirty 43.94 MiB 48.94 MiB 5.00 MiB
20fbd51+dirty 49.74 MiB 54.81 MiB 5.07 MiB
0a147b2+dirty 49.74 MiB 55.08 MiB 5.34 MiB
a5d243c+dirty 48.30 MiB 53.54 MiB 5.23 MiB
2363c0f+dirty 49.74 MiB 54.84 MiB 5.10 MiB
5257d80+dirty 48.30 MiB 53.58 MiB 5.28 MiB
0a9e622+dirty 49.74 MiB 55.09 MiB 5.34 MiB

lucas-zimerman
lucas-zimerman approved these changes Jul 7, 2026
View reviewed changes

@lucas-zimerman lucas-zimerman left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@antonis antonis merged commit 39909f1 into main Jul 7, 2026
155 of 194 checks passed
@antonis antonis deleted the fix/js-yaml-cve-2026-53550 branch July 7, 2026 13:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lucas-zimerman lucas-zimerman lucas-zimerman approved these changes
@alwx alwx Awaiting requested review from alwx alwx is a code owner

Assignees

No one assigned

Labels

ready-to-merge Triggers the full CI test suite skip-changelog

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@antonis @lucas-zimerman