Skip to content

chore(deps): bump js-yaml from 3.14.2 to 3.15.1 in the security group across 1 directory - #320

Merged
radius-dependabot-manager[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/security-88f2d97871
Aug 5, 2026
Merged

chore(deps): bump js-yaml from 3.14.2 to 3.15.1 in the security group across 1 directory#320
radius-dependabot-manager[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/security-88f2d97871

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 16, 2026

Copy link
Copy Markdown
Contributor

Bumps the security group with 1 update in the / directory: js-yaml.

Updates js-yaml from 3.14.2 to 3.15.1

Changelog

Sourced from js-yaml's changelog.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.
Commits

@dependabot @github

dependabot Bot commented on behalf of github Jul 16, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: deps/npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 16, 2026
@dependabot
dependabot Bot requested review from a team as code owners July 16, 2026 04:02
@github-actions

github-actions Bot commented Jul 16, 2026

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/js-yaml 3.15.1 🟢 6.1
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 1Found 3/30 approved changesets -- score normalized to 1
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 3dependency not pinned by hash detected -- score normalized to 3
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy🟢 4security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • yarn.lock

@radius-dependabot-manager
radius-dependabot-manager Bot enabled auto-merge (squash) July 16, 2026 04:02
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/security-88f2d97871 branch from 2232c44 to a95ac45 Compare July 30, 2026 21:45
@lakshmimsft

Copy link
Copy Markdown

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

Sorry, only users with push access can use that command.

@lakshmimsft

Copy link
Copy Markdown

@dependabot rebase

Bumps the security group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).


Updates `js-yaml` from 3.14.2 to 3.15.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.2...3.15.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 3.15.0
  dependency-type: indirect
  dependency-group: security
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump js-yaml from 3.14.2 to 3.15.0 in the security group across 1 directory chore(deps): bump js-yaml from 3.14.2 to 3.15.1 in the security group across 1 directory Aug 5, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/security-88f2d97871 branch from a95ac45 to 030d5cf Compare August 5, 2026 23:43
@radius-dependabot-manager
radius-dependabot-manager Bot merged commit 5279ead into main Aug 5, 2026
5 checks passed
@radius-dependabot-manager
radius-dependabot-manager Bot deleted the dependabot/npm_and_yarn/security-88f2d97871 branch August 5, 2026 23:46
Copilot AI pushed a commit that referenced this pull request Aug 6, 2026
… across 1 directory (#320)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lakshmimsft <103459615+lakshmimsft@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant