Update js-yaml to 4.3.1 to resolve Dependabot security alert #52

[pedrazamiguez]

Problem / Motivation

• Dependabot has reported a high-severity security vulnerability in the js-yaml dependency (GHSA-5p4m-2wfm-xmqj) located in functions/package-lock.json.
• Versions of js-yaml between 4.0.0 and 4.3.0 suffer from quadratic CPU consumption in !!omap resolution, which can block the Node.js event loop and lead to a Denial of Service (DoS) when parsing untrusted YAML.
• Resolving this is necessary to ensure the security and availability of the functions backend and to clear Dependabot alert Expense automatically updates group summary #52.

Proposed Solution

• Update the js-yaml dependency to the patched version (4.3.1) in the functions directory.
• Regenerate the functions/package-lock.json to reflect the updated transitive or direct dependency.
• Verify that the update does not introduce breaking changes or compatibility issues with existing code in the functions module.

Acceptance Criteria

• The js-yaml dependency in functions/package-lock.json is updated to at least version 4.3.1.
• All existing tests pass; new tests added where behaviour changes.
• make fast-check passes during iterative development (~15–30s).
• make check > build.log 2>&1 && echo "Check passed successfully" || (tail -n 100 build.log && exit 1) passes with 0 failures before merging.
• No new detekt findings introduced.

Out of Scope

• Major version upgrades of js-yaml (e.g., to 5.x) or other dependencies unrelated to this specific alert, unless strictly necessary for compatibility.
• Any refactoring outside of the functions module.

Related Issues / PRs

• Dependabot Alert 52: js-yaml Quadratic CPU consumption

[github-actions]

🌱 Branch created

internal/SPLTRP-1515

This branch has been automatically created based on develop.

🚀 Getting started

Fetch and switch to this branch with the latest changes from develop:

git fetch origin
git checkout internal/SPLTRP-1515
git pull origin develop

📌 When creating your PR

• Base branch: develop
• Title:

  [SPLTRP-1515]: Update js-yaml to 4.3.1 to resolve Dependabot security alert #52
  

• Description: Closes #1515

[pedrazamiguez]

Resolve Dependabot Alert #52 (js-yaml)

Update the js-yaml transitive dependency in the functions module to version 4.3.1 to resolve the quadratic CPU consumption vulnerability (GHSA-5p4m-2wfm-xmqj). This requires updating the NPM overrides and regenerating the lockfile.

User Review Required

No significant architectural changes or breaking changes are expected. This is a targeted patch for a transitive dependency.

Open Questions

None. The issue provides clear acceptance criteria.

Proposed Changes

NPM Configuration (Functions)

Update the NPM overrides in the functions module to force resolution of the secure js-yaml version.

[MODIFY] package.json

Update the overrides block to require at least ^4.3.1 instead of ^4.3.0:

  "overrides": {
    "@tootallnate/once": "^3.0.1",
    "uuid": "^11.1.1",
    "js-yaml": "^4.3.1",
    "body-parser": "^1.20.6",
    "@babel/core": "^7.29.6"
  }

[MODIFY] package-lock.json

• Run npm install inside the functions/ directory to regenerate the package-lock.json.
• This will apply the new override and update the locked version of js-yaml throughout the dependency tree.

Verification Plan

Automated Tests

• Run unit tests in the functions module to ensure nothing broke:

  cd functions && npm run test

• Run the fast quality check target:

  make fast-check

• Run the full quality check target (simulates CI):

  make check > build.log 2>&1 && echo "Check passed successfully" || (tail -n 100 build.log && exit 1)

Manual Verification

• Inspect the generated functions/package-lock.json manually (e.g., using grep js-yaml functions/package-lock.json) to confirm all instances of js-yaml resolve to >= 4.3.1 and not versions between 4.0.0 and 4.3.0.

[pedrazamiguez]

Walkthrough: Implementation Complete

This issue has been implemented successfully following the provided plan.

Changes Made

• Modified functions/package.json to force NPM resolution of js-yaml to ^4.3.1 using overrides.
• Regenerated functions/package-lock.json by running npm install in the functions directory.
• Confirmed that npm ls js-yaml resolves to 4.3.1 (securely deduped) for all transitive dependencies.

Testing and Validation Results

• npm run test passed successfully in the functions directory.
• make fast-check passed successfully with no static analysis issues or failing coverage gates.
• make check full cold verification completed successfully with 0 failures.

No breaking changes or regressions were detected, and the alert vulnerability has been safely resolved.