From 03cc8080c0e0e55443a959e0edd70d2e47f5ebb4 Mon Sep 17 00:00:00 2001
From: berkay-byte <berkaypehlivab29@gmail.com>
Date: Sat, 19 Sep 2026 12:18:43 +0300
Subject: [PATCH] fix(deps): patch js-yaml merge-source denial of service

---
 core/package-lock.json                   |  9 +++++----
 core/package.json                        |  2 +-
 core/test/unit/yaml-merge-budget.test.js | 17 +++++++++++++++++
 package-lock.json                        |  6 ++++--
 4 files changed, 27 insertions(+), 7 deletions(-)
 create mode 100644 core/test/unit/yaml-merge-budget.test.js

diff --git a/core/package-lock.json b/core/package-lock.json
index 10e9845a..3a2e8395 100644
--- a/core/package-lock.json
+++ b/core/package-lock.json
@@ -43,7 +43,7 @@
         "handlebars": "^4.7.8",
         "identity-obj-proxy": "^3.0.0",
         "jest": "^30.2.0",
-        "js-yaml": "^3.14.2",
+        "js-yaml": "^3.15.2",
         "supertest": "^7.2.2",
         "ts-jest": "^29.4.6",
         "tsx": "^4.21.0",
@@ -6847,10 +6847,11 @@
       "dev": true
     },
     "node_modules/js-yaml": {
-      "version": "3.14.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
+      "version": "3.15.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
+      "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "argparse": "^1.0.7",
         "esprima": "^4.0.0"
diff --git a/core/package.json b/core/package.json
index 90dbaa92..0f0ebfd7 100644
--- a/core/package.json
+++ b/core/package.json
@@ -76,7 +76,7 @@
     "handlebars": "^4.7.8",
     "identity-obj-proxy": "^3.0.0",
     "jest": "^30.2.0",
-    "js-yaml": "^3.14.2",
+    "js-yaml": "^3.15.2",
     "supertest": "^7.2.2",
     "ts-jest": "^29.4.6",
     "tsx": "^4.21.0",
diff --git a/core/test/unit/yaml-merge-budget.test.js b/core/test/unit/yaml-merge-budget.test.js
new file mode 100644
index 00000000..f3ca2f01
--- /dev/null
+++ b/core/test/unit/yaml-merge-budget.test.js
@@ -0,0 +1,17 @@
+const yaml = require('js-yaml');
+
+describe('YAML merge resource limits', () => {
+  it('counts empty mappings toward the merge budget', () => {
+    const source = 'empty: &empty {}\nmerged:\n  <<: [*empty, *empty, *empty]\n';
+
+    expect(() => yaml.safeLoad(source, { maxTotalMergeKeys: 2 }))
+      .toThrow(/maxTotalMergeKeys/);
+  });
+
+  it('still supports ordinary YAML merges within the budget', () => {
+    const source = 'defaults: &defaults {enabled: true}\nmerged:\n  <<: *defaults\n  name: example\n';
+
+    expect(yaml.safeLoad(source, { maxTotalMergeKeys: 10 }).merged)
+      .toEqual({ enabled: true, name: 'example' });
+  });
+});
diff --git a/package-lock.json b/package-lock.json
index f7483395..3f53b7d2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -62,7 +62,7 @@
                 "handlebars": "^4.7.8",
                 "identity-obj-proxy": "^3.0.0",
                 "jest": "^30.2.0",
-                "js-yaml": "^3.14.2",
+                "js-yaml": "^3.15.2",
                 "supertest": "^7.2.2",
                 "ts-jest": "^29.4.6",
                 "tsx": "^4.21.0",
@@ -6885,7 +6885,9 @@
             "license": "MIT"
         },
         "node_modules/js-yaml": {
-            "version": "3.14.2",
+            "version": "3.15.2",
+            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
+            "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
             "dev": true,
             "license": "MIT",
             "dependencies": {