build(deps): Bump yaml from 2.9.0 to 2.9.1 - #803
Conversation
dependabot
Bot
added
dependencies
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Thanks @dependabot[bot] for keeping our dependencies current! 🙌 |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
hermes-exosphere
left a comment
hermes-exosphere
left a comment
There was a problem hiding this comment.
Approved automatically by the Hermes Dependabot approver.
5cc46d5 to
8d794fb
Compare
Bumps [yaml](https://github.com/eemeli/yaml) from 2.9.0 to 2.9.1. - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.9.0...v2.9.1) --- updated-dependencies: - dependency-name: yaml dependency-version: 2.9.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
OSV-Scanner flags rustls 0.23.43 (RUSTSEC-2026-0285, CVSS 5.3, fixed in 0.23.45), which fails the Supply Chain gate on main and on every PR. rustls is transitive-only, via reqwest in failproofaid and fpai-collect. `cargo update -p rustls --precise 0.23.45` also moves rustls-webpki 0.103.13 -> 0.103.15, which the new rustls requires. Also opens the 1.0.6-beta.0 changelog section for this PR's entry. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017HpjSQY3i7mJj9UWHXgacg
49f2b1c
8d794fb to
49f2b1c
Compare
hermes-exosphere
left a comment
hermes-exosphere
left a comment
There was a problem hiding this comment.
Approved automatically by the Hermes Dependabot approver.
2 participants
Why this PR was red, and what was added on top of dependabot's bump
test(all 3 matrix jobs): 18domsuites failed to load withIncompatible React versions: react 19.2.8, react-dom 19.3.0. Nothing to do with yaml: the branch was cut fromfea76749, after the react-dom bump (#801) but before the matching react bump (#802). Fix: rebased ontomain(a0e17ae1), which carries both at 19.3.0. Locally: 262/262 test files, 4902 tests pass.OSV-Scanner (Supply Chain): RUSTSEC-2026-0285 against
rustls 0.23.43inCargo.lock(CVSS 5.3, fixed in 0.23.45). This was red onmaintoo, independent of this PR. Fix:cargo update -p rustls --precise 0.23.45, which also movesrustls-webpki0.103.13 → 0.103.15. rustls is transitive-only, viareqwestinfailproofaidandfpai-collect.cargo clippy --workspace --all-targets -- -D warningsandcargo test --workspacepass locally.Also opens the
1.0.6-beta.0CHANGELOG section with a Dependencies entry for both bumps.Bumps yaml from 2.9.0 to 2.9.1.
Release notes
Sourced from yaml's releases.
Commits
1440ecd2.9.1c699bc5fix: Simplify line unfolding during quoted string parsing (#714)d11ce77fix: Limit recursive merge aliases (#713)c5f49f4chore: Update docs-slate🤖 Generated with Claude Code
https://claude.ai/code/session_017HpjSQY3i7mJj9UWHXgacg