Skip to content

[sec-check] fix: bump discord js-yaml 4.3.1 → 4.3.2 (GHSA-2883-xcg3-v3hh) - #6336

Merged
kubestellar-prow[bot] merged 1 commit into
v4from
sec/js-yaml-4.3.2
Sep 9, 2026
Merged

[sec-check] fix: bump discord js-yaml 4.3.1 → 4.3.2 (GHSA-2883-xcg3-v3hh)#6336
kubestellar-prow[bot] merged 1 commit into
v4from
sec/js-yaml-4.3.2

Conversation

@kubestellar-hive

@kubestellar-hive kubestellar-hive Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

Security Fix

Bumps discord/package.json + discord/package-lock.json only: js-yaml ^4.3.1 → ^4.3.2, fixing GHSA-2883-xcg3-v3hh (maxTotalMergeKeys does not limit CPU use for empty merge sources; CWE-400/407, CVSS 7.5, availability-only). Vulnerable range >=4.0.0 <4.3.2.

Sole usage site is discord/lib/config.js:21 (yaml.load of the operator-owned hive-project.yaml), so practical risk is a bot-side CPU DoS — but the fix is a zero-API-change patch release on the same 4.x line.

Verified: npm audit --omit=dev clean after bump; yaml.load smoke-tested with 4.3.2 against the config.js usage pattern.

Claims only discord/package.json + discord/package-lock.json — disjoint from open hold-gated PRs #6330 (src/pkg/agent), #6327 (src/pkg/hub aliases), #6309 (v4→v5 sync), #6292 (claude write roots).

Fixes #6335

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=sec-check backend=copilot model=claude-fable-5

sec-check
[sec-check] fix: bump discord js-yaml 4.3.1 -> 4.3.2 (GHSA-2883-xcg3-…
b733780 
…v3hh)

CPU-exhaustion via empty merge sources (CWE-400/407, CVSS 7.5).
Patch bump on the same 4.x line; npm audit now clean, yaml.load
smoke-tested against discord/lib/config.js usage.

Refs #6335

Signed-off-by: sec-check <sec-check@hive.kubestellar.io>
@kubestellar-hive kubestellar-hive Bot added the hold label Sep 9, 2026
@kubestellar-prow kubestellar-prow Bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Sep 9, 2026
@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.

@kubestellar-prow kubestellar-prow Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Sep 9, 2026
This was referenced Sep 9, 2026
Merged
Merged
@clubanderson clubanderson added lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Sep 9, 2026
@kubestellar-prow

kubestellar-prow Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubestellar-prow
kubestellar-prow Bot merged commit ef77af0 into v4 Sep 9, 2026
26 checks passed
@kubestellar-prow
kubestellar-prow Bot deleted the sec/js-yaml-4.3.2 branch September 9, 2026 13:36
@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback

@kubestellar-hive kubestellar-hive Bot mentioned this pull request Sep 9, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. copilot dco-signoff: yes Indicates the PR's author has signed the DCO. hold lgtm Indicates that a PR is ready to be merged. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[sec-check] discord: js-yaml 4.3.1 vulnerable to GHSA-2883-xcg3-v3hh (CPU exhaustion via merge keys) — bump to 4.3.2

1 participant

@clubanderson