[thaJeztah]

resolve: hint-class literal merge-key string "<<" so it's quoted on encode

full diff: yaml/go-yaml@v3.0.5...v3.0.6

• Contains a security fix (no advisory); v3: resolve: hint-class literal merge-key string "<<" so it's quoted on encode yaml/go-yaml#434 (comment)

So is this a REAL security fix for v3?

YES, absolutely! Here's why:

1. The vulnerability is real — A map key with literal value "<<" gets encoded unquoted, then decoded as a YAML merge directive, causing keys to be injected into the wrong scope.
2. v3 is vulnerable — v3 doesn't have the fix that v4 has, so the attack works.
3. The PR fixes it — Adding t[int('<')] = 'M' registers the hint byte, so "<<" gets quoted on encode, preventing misinterpretation on decode.
4. It's security-critical — While the PR description is matter-of-fact, this prevents key injection attacks where an attacker-controlled map value could splice their keys into your data structure.

Your original concern was valid: You were right to wonder if it was a real security issue or just paperwork. It's very real — but it's been quietly fixed in v4, and now being ported to v3's frozen maintenance branch.