Repository navigation
fix: backport bundled YAML security to 0.2 - #19
Merged
Merged
Conversation
Preserve the installed 0.2 API while enforcing merge budgets in both actual packaged module formats. Bind maintenance tarballs to the verified source commit and publish without replacing latest.
Contributor
Author
|
Verified exact head 1c9fade: required hosted Build success (37152359525), all source/types/lint/build/28 Node/20 real packed gates successful. Independent spec/quality reviews and ordering correction retained in repository. Scoped maintenance branch/tag rules active; existing defaults unchanged. Copilot requested through gh pr edit; no approving GitHub receipt available. Under standing operator authorization, admin merge is solely an ordinary-review exception, not bypass of a failed/missing Build. Release remains gated on merged source identity, free immutable version, publisher success and downloaded consumer proof. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Compatible 0.2.1 maintenance backport: upgrade the actual bundled js-yaml to
4.3.2 without changing exports, peers or serialization contracts. Verify both
source exports and real extracted ESM/CommonJS consumers. Stage a commit-bound
tarball and publish it with maintenance-0.2, never replacing latest.
Scope
Design: docs/plans/2026-10-03-editor-02-parser-security-design.md
Plan: docs/plans/2026-10-03-editor-02-parser-security.md
PR Count: 1; Tasks: 3; Status: Locked 2026-10-03T19:46:17Z.
Owning row: Backport bundled YAML security to editor 0.2, Tasks 1-3,
fix/editor-02-yaml-security. Base: release/0.2.x at published v0.2.0,
1df78d7.
Reviewed head: 1c9fade.
Verification
Fresh ordinary clone initially had neither dist nor node_modules. Node 22.23.1,
npm 10.9.8, owned private cache. npm ci, full types, targeted lint and build
exited 0; 79 source tests, 28 Node tests and 20 actual packed consumer cases
passed. Source and lockfile remained byte-identical/clean. Package exports,
peers and build configuration unchanged; exactly one YAML closure at 4.3.2.
Old dependency failed the hostile-merge rejection; restored dependency passes.
Actual guard fixtures reject wrong tag, version, commit, dirty source and remote
ancestry. Actionlint clean. Independent spec/quality review retained in code
review report; one important build-before-packer-test finding corrected and
covered by graph assertions.
Runtime Launch Transcript
Build: npm run build, exit 0 in clean checkout.
Launch: node scripts/pack-maintenance.mjs , exit 0;
generated package version 0.2.1, gitHead
1c9fade.
node scripts/verify-yaml-security.mjs , exit 0:
20/20 ESM/CJS public-utils consumer cases; valid parameterized resources,
malformed syntax and merge-budget acceptance/rejection.
Failure-signature scrape: clean. Verdict: PASS for local packed consumers,
not a claim of published release.
Release And Remaining Gates
Hosted Build, scoped maintenance branch/tag protection, merge, automatic-token
publication, registry integrity/gitHead and downloaded-consumer proof remain
required before release completion. Current latest is v0.85.4; this patch must
not displace it. Current-line compatible security follow-up remains separate.
npm ci reports 15 preexisting audit findings; this is a bundled-YAML fix, not
an assertion that the whole editor dependency inventory is vulnerability-free.
No named secret, self-hosted runner, IDE dispatch, Workflow authority edit or
published artifact mutation. Rollback is hold/forward patch, not tag overwrite.
Doc-reconciliation: clean. Operational gates remain explicitly pending;
no claim of Signal or Workflow prerequisite completion.