Merge pull request #144 from actions/dependabot/npm_and_yarn/js-yaml-4.1.1

chore(deps): bump js-yaml from 4.1.0 to 4.1.1

.licenses/npm/js-yaml.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: js-yaml
-version: 4.1.0
+version: 4.1.1
 type: npm
 summary: YAML 1.2 parser and serializer
 homepage:

dist/index.js

@@ -58344,7 +58344,7 @@ function buildInferenceRequest(promptConfig, systemPrompt, prompt, modelName, te
     };
 }
 
-/*! js-yaml 4.1.0 https://github.com/nodeca/js-yaml @license MIT */
+/*! js-yaml 4.1.1 https://github.com/nodeca/js-yaml @license MIT */
 function isNothing(subject) {
   return (typeof subject === 'undefined') || (subject === null);
 }
@@ -59555,6 +59555,22 @@ function charFromCodepoint(c) {
   );
 }
 
+// set a property of a literal object, while protecting against prototype pollution,
+// see https://github.com/nodeca/js-yaml/issues/164 for more details
+function setProperty(object, key, value) {
+  // used for this specific key only because Object.defineProperty is slow
+  if (key === '__proto__') {
+    Object.defineProperty(object, key, {
+      configurable: true,
+      enumerable: true,
+      writable: true,
+      value: value
+    });
+  } else {
+    object[key] = value;
+  }
+}
+
 var simpleEscapeCheck = new Array(256); // integer, for fast access
 var simpleEscapeMap = new Array(256);
 for (var i = 0; i < 256; i++) {
@@ -59733,7 +59749,7 @@ function mergeMappings(state, destination, source, overridableKeys) {
     key = sourceKeys[index];
 
     if (!_hasOwnProperty$1.call(destination, key)) {
-      destination[key] = source[key];
+      setProperty(destination, key, source[key]);
       overridableKeys[key] = true;
     }
   }
@@ -59793,17 +59809,7 @@ function storeMappingPair(state, _result, overridableKeys, keyTag, keyNode, valu
       throwError(state, 'duplicated mapping key');
     }
 
-    // used for this specific key only because Object.defineProperty is slow
+    setProperty(_result, keyNode, valueNode);
-    if (keyNode === '__proto__') {
-      Object.defineProperty(_result, keyNode, {
-        configurable: true,
-        enumerable: true,
-        writable: true,
-        value: valueNode
-      });
-    } else {
-      _result[keyNode] = valueNode;
-    }
     delete overridableKeys[keyNode];
   }
 

package-lock.json

@@ -13,7 +13,7 @@
         "@modelcontextprotocol/sdk": "^1.24.0",
         "@rollup/rollup-linux-x64-gnu": "*",
         "@types/tmp": "^0.2.6",
-        "js-yaml": "^4.1.0",
+        "js-yaml": "^4.1.1",
         "openai": "^5.11.0",
         "pkce-challenge": "^5.0.0",
         "tmp": "^0.2.4"
@@ -6484,9 +6484,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.1.0",
+      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
       "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1"

package.json

@@ -26,7 +26,7 @@
     "@actions/core": "^1.11.1",
     "@modelcontextprotocol/sdk": "^1.24.0",
     "@types/tmp": "^0.2.6",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.1.1",
     "openai": "^5.11.0",
     "pkce-challenge": "^5.0.0",
     "tmp": "^0.2.4"