chore(deps): update pnpm-workspace.overrides markdownlint-cli2>js-yaml to ^4.3.2 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
markdownlint-cli2>js-yaml	^4.3.1 → ^4.3.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

GHSA-5p4m-2wfm-xmqj

More information

Details

Quadratic CPU consumption in !!omap resolution (js-yaml 3.x and 4.x)

Summary

resolveYamlOmap() enforces key uniqueness for !!omap sequences with a linear
scan (objectKeys.indexOf(...)) inside the per-element loop, making resolution
O(n²) in the number of entries. A modestly sized YAML document therefore
consumes disproportionate CPU inside yaml.load(), giving a denial of service
against any consumer that parses untrusted YAML.

!!omap is registered in the default schema
(lib/schema/default.js → require('../type/omap')), so a plain
yaml.load(untrustedInput) with no options is affected — no custom schema or
non-default configuration is required.

This is the same weakness as CVE-2026-59870 / GHSA-724g-mxrg-4qvm, which was
fixed in the 5.x line in 5.2.1. That fix was never backported: both currently
maintained legacy lines still carry the original implementation.

Affected versions

Line	Latest tested	Status
3.x	3.15.0	Affected — objectKeys.indexOf(pairKey) at lib/type/omap.js:29
4.x	4.3.0	Affected — objectKeys.indexOf(pairKey) at lib/type/omap.js:30
5.x	5.2.2	Not affected — fixed in 5.2.1 (uses a Set)

Both figures are the newest release of each line at the time of writing, so
this is not a "you are on an old version" issue.

Details

lib/type/omap.js (js-yaml 4.3.0):

if (objectKeys.indexOf(pairKey) === -1) objectKeys.push(pairKey)
else return false

objectKeys grows by one element per entry, and Array.prototype.indexOf is a
linear scan, so resolving an n-entry !!omap performs roughly
1 + 2 + … + n comparisons — quadratic in n. The work happens synchronously
inside yaml.load(), blocking the event loop for its whole duration.

The 5.x line already solves exactly this by tracking seen keys in a Set
(src/tag/sequence/omap.ts):

if (carrier.seen.has(key)) return 'duplicate key in ordered map'
carrier.seen.add(key)

Proof of concept

// poc.js  —  node poc.js
const yaml = require('js-yaml');
const doc = n => '!!omap\n' + Array.from({length: n}, (_, i) => `- k${i}: ${i}`).join('\n') + '\n';

for (const n of [10000, 20000, 40000, 80000]) {
  const d = doc(n), t = Date.now();
  yaml.load(d);                      // default schema, no options
  console.log(`n=${n} bytes=${d.length} load=${Date.now() - t}ms`);
}

Measured (node v20.20.2, default heap, no flags)

js-yaml 4.3.0

n=10000  bytes=137787   load=54ms
n=20000  bytes=297787   load=169ms
n=40000  bytes=617787   load=646ms
n=80000  bytes=1257787  load=2607ms

js-yaml 3.15.0

n=10000  bytes=137787   load=53ms
n=20000  bytes=297787   load=166ms
n=40000  bytes=617787   load=641ms
n=80000  bytes=1257787  load=2567ms

Runtime grows by a factor of ~4 for each doubling of n, which is the
signature of O(n²) (linear growth would be ~2×).

Scaling further: a 2.48 MB document with 150,000 entries blocked
yaml.load() for 10.8 seconds.

Impact

Any service that parses attacker-influenced YAML with js-yaml 3.x or 4.x can be
stalled with a small input. Because the loop is synchronous, a single request
blocks the Node.js event loop and stalls every other request in the process —
so the amplification is per-process, not just per-request.

Suggested severity: consistent with CVE-2026-59870 (the same weakness in
5.x), i.e. Availability-only impact, network attack vector, no privileges or
user interaction required.

Suggested fix

Mirror the 5.x fix — replace the linear scan with a Set:

// lib/type/omap.js
const seen = new Set()
// ...
if (seen.has(pairKey)) return false
seen.add(pairKey)

This preserves the existing duplicate-key rejection semantics exactly while
making resolution O(n). A maxOmapLength-style cap would also work, but the
Set matches what 5.x already ships and requires no new option.

References

• CVE-2026-59870 / GHSA-724g-mxrg-4qvm — same weakness in 5.0.0–5.2.0, fixed in 5.2.1
• lib/type/omap.js (3.x, 4.x) — the affected resolver
• lib/schema/default.js — registers !!omap in the default schema

Discovery

Found by an automated static-analysis and executed-proof-of-concept scanner run
against js-yaml 4.2.0, then manually verified against 3.15.0 and 4.3.0 by
executing the proof of concept above. All timings in this report were measured
on the current releases of each line, not on the version originally scanned.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj
• https://github.com/advisories/GHSA-5p4m-2wfm-xmqj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

CVE-2026-84375 / GHSA-2883-xcg3-v3hh

More information

Details

Summary

maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit.

Example

arr: &arr [{}, {}, {}, ...] # N empty mappings
targets:
  - <<: *arr                # repeated K times

For every target, the loader iterates all N elements of arr. This results in O(N * K) work while totalMergeKeys remains unchanged.

PoC

import { performance } from 'node:perf_hooks'
import { load, YAML11_SCHEMA } from 'js-yaml'

const n = 20000

const src =
  'arr: &arr [' + '{},'.repeat(n).slice(0, -1) + ']\n' +
  'targets:\n' +
  '  - <<: *arr\n'.repeat(n)

const started = performance.now()

load(src, { schema: YAML11_SCHEMA })

console.log(`${(performance.now() - started).toFixed(1)} ms`)

Observed results:

N	YAML size	Time
800	~13 KB	~20 ms
3200	~50 KB	~180 ms
20000	~500 KB	~13 s

Impact

An attacker can submit a relatively small YAML document that causes prolonged CPU consumption despite the default maxTotalMergeKeys limit.

Fix

Count each merge-source mapping as one budget unit, in addition to counting its keys.

Difference with v5

In v3 & v4, merge is enabled by default. So, the severity score is higher.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh
• https://nvd.nist.gov/vuln/detail/CVE-2026-84375
• https://github.com/nodeca/js-yaml/pull/797
• https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639
• https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480
• https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b
• https://github.com/nodeca/js-yaml/releases/tag/3.15.2
• https://github.com/nodeca/js-yaml/releases/tag/4.3.2
• https://github.com/advisories/GHSA-2883-xcg3-v3hh

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

nodeca/js-yaml (markdownlint-cli2>js-yaml)

v4.3.2

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Preview site

pr-179: https://pr-179--stuartclark.netlify.app

Updated 2026-09-09T09:58:08Z

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.77%. Comparing base (a69e233) to head (81967fb).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #179   +/-   ##
=======================================
  Coverage   99.77%   99.77%           
=======================================
  Files          79       79           
  Lines        1323     1323           
  Branches      332      332           
=======================================
  Hits         1320     1320           
  Misses          3        3           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

✅ Lighthouse Audit · unknown

All pages within budget — 13 pages scanned.

Route	FCP	LCP	CLS	TBT	Perf
/	✅ 2.8s	✅ 3.0s	✅ 0.009	✅ 11.500	✅ 0.90
/about	✅ 2.6s	✅ 3.2s	✅ 0.178	✅ 18.000	✅ 0.81
/community	✅ 2.6s	✅ 2.7s	✅ 0.016	✅ 46.000	✅ 0.92
/open-source	✅ 2.8s	✅ 4.8s	✅ 0.000	✅ 0.000	✅ 0.78
/writing	✅ 2.7s	✅ 2.9s	✅ 0.000	✅ 1.000	✅ 0.91
/writing/custom-formatters-410-20260731	✅ 3.0s	✅ 3.4s	✅ 0.063	✅ 0.000	✅ 0.85
/writing/decoupling-configuration-config-pages-20220412	✅ 2.8s	✅ 3.1s	✅ 0.015	✅ 0.000	✅ 0.90
/writing/drupal-site-settings-over-jsonapi-consumer-20260826	✅ 2.9s	✅ 3.4s	✅ 0.159	✅ 0.000	✅ 0.79
/writing/druxt-drupal-13x-resource-list-yours-20260909	✅ 3.2s	✅ 3.5s	✅ 0.058	✅ 0.000	✅ 0.84
/writing/field-tokens-200-20260722	✅ 2.7s	✅ 2.9s	✅ 0.019	✅ 0.000	✅ 0.91
/writing/hello-world-20211126	✅ 2.9s	✅ 3.0s	✅ 0.142	✅ 0.000	✅ 0.84
/writing/jsonapi-views-120-20260812	✅ 2.7s	✅ 2.8s	✅ 0.005	✅ 17.500	✅ 0.91
/writing/layout-paragraphs-module-20220301	✅ 2.7s	✅ 2.7s	✅ 0.055	✅ 0.000	✅ 0.91

Thresholds: FCP ≤ 3.5s, LCP ≤ 5.0s, CLS ≤ 0.25, TBT ≤ 600.000, Perf ≥ 0.75