Skip to content

fix: js-yaml upgrade#6903

Open
rossmcewan wants to merge 1 commit into
masterfrom
ross/20260724/fix-vulns-js-yaml
Open

fix: js-yaml upgrade#6903
rossmcewan wants to merge 1 commit into
masterfrom
ross/20260724/fix-vulns-js-yaml

Conversation

@rossmcewan

@rossmcewan rossmcewan commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Review in cubic

@rossmcewan
rossmcewan requested a review from a team July 24, 2026 09:07
@rossmcewan
rossmcewan enabled auto-merge July 24, 2026 09:09

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 issue found across 9 files

Confidence score: 3/5

  • In packages/nango-yaml/package.json, the YAML upgrade appears to change parsing of numeric-separator literals (for example count: 1_000) from numbers to strings, which can break or silently alter nango.yaml model parsing at runtime; pin/adjust the parser configuration or add a compatibility transform so these values remain numeric.
Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/nango-yaml/package.json">

<violation number="1" location="packages/nango-yaml/package.json:16">
P2: Existing `nango.yaml` model literals that use YAML numeric separators, such as `count: 1_000`, are now loaded as strings rather than numbers after this upgrade, which can alter or break model parsing. Preserving the old interpretation through a compatibility normalization/migration (and adding a regression test) would avoid silently changing existing configurations.</violation>
</file>

Reply with feedback, questions, or to request a fix.

Re-trigger cubic

},
"dependencies": {
"js-yaml": "4.1.1",
"js-yaml": "4.3.0",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Existing nango.yaml model literals that use YAML numeric separators, such as count: 1_000, are now loaded as strings rather than numbers after this upgrade, which can alter or break model parsing. Preserving the old interpretation through a compatibility normalization/migration (and adding a regression test) would avoid silently changing existing configurations.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/nango-yaml/package.json, line 16:

<comment>Existing `nango.yaml` model literals that use YAML numeric separators, such as `count: 1_000`, are now loaded as strings rather than numbers after this upgrade, which can alter or break model parsing. Preserving the old interpretation through a compatibility normalization/migration (and adding a regression test) would avoid silently changing existing configurations.</comment>

<file context>
@@ -13,7 +13,7 @@
     },
     "dependencies": {
-        "js-yaml": "4.1.1",
+        "js-yaml": "4.3.0",
         "ms": "3.0.0-canary.1"
     },
</file context>

@rossmcewan
rossmcewan disabled auto-merge July 24, 2026 09:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants