@zuplo/cli 7.7.2 → 7.7.4

package/node_modules/js-yaml/lib/loader.js

@@ -371,19 +371,28 @@ function captureSegment (state, start, end, checkJson) {
   }
 }
 
+function chargeMergeWork (state) {
+  state.totalMergeKeys++
+
+  if (state.maxTotalMergeKeys !== -1 && state.totalMergeKeys > state.maxTotalMergeKeys) {
+    throwError(state, 'merge keys exceeded maxTotalMergeKeys (' + state.maxTotalMergeKeys + ')')
+  }
+}
+
 function mergeMappings (state, destination, source, overridableKeys) {
   if (!common.isObject(source)) {
     throwError(state, 'cannot merge mappings; the provided source object is unacceptable')
   }
 
+  // Count the source mapping itself to bound sequences of empty mappings.
+  chargeMergeWork(state)
+
   const sourceKeys = Object.keys(source)
 
   for (let index = 0, quantity = sourceKeys.length; index < quantity; index += 1) {
     const key = sourceKeys[index]
 
-    if (state.maxTotalMergeKeys !== -1 && ++state.totalMergeKeys > state.maxTotalMergeKeys) {
-      throwError(state, 'merge keys exceeded maxTotalMergeKeys (' + state.maxTotalMergeKeys + ')')
-    }
+    chargeMergeWork(state)
 
     if (!_hasOwnProperty.call(destination, key)) {
       setProperty(destination, key, source[key])
@@ -426,6 +435,10 @@ function storeMappingPair (state, _result, overridableKeys, keyTag, keyNode, val
 
   if (keyTag === 'tag:yaml.org,2002:merge') {
     if (Array.isArray(valueNode)) {
+      if (valueNode.length > 100) {
+        throwError(state, 'abnormal merge sequence size')
+      }
+
       for (let index = 0, quantity = valueNode.length; index < quantity; index += 1) {
         mergeMappings(state, _result, valueNode[index], overridableKeys)
       }

package/node_modules/js-yaml/lib/type/omap.js

@@ -8,7 +8,7 @@ const _toString = Object.prototype.toString
 function resolveYamlOmap (data) {
   if (data === null) return true
 
-  const objectKeys = []
+  const objectKeys = {}
   const object = data
 
   for (let index = 0, length = object.length; index < length; index += 1) {
@@ -27,8 +27,8 @@ function resolveYamlOmap (data) {
 
     if (!pairHasKey) return false
 
-    if (objectKeys.indexOf(pairKey) === -1) objectKeys.push(pairKey)
-    else return false
+    if (_hasOwnProperty.call(objectKeys, pairKey)) return false
+    Object.defineProperty(objectKeys, pairKey, { value: true })
   }
 
   return true

package/node_modules/js-yaml/package.json

@@ -1,6 +1,6 @@
 {
   "name": "js-yaml",
-  "version": "4.3.0",
+  "version": "4.3.2",
   "description": "YAML 1.2 parser and serializer",
   "keywords": [
     "yaml",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/cli",
-  "version": "7.7.2",
+  "version": "7.7.4",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "type": "module",
@@ -28,10 +28,10 @@
     "@opentelemetry/api": "1.9.0",
     "@opentelemetry/api-logs": "0.220.0",
     "@swc/core": "1.10.18",
-    "@zuplo/core": "7.7.2",
+    "@zuplo/core": "7.7.4",
     "@zuplo/editor": "1.0.33162667821",
-    "@zuplo/openapi-tools": "7.7.2",
-    "@zuplo/runtime": "7.7.2",
+    "@zuplo/openapi-tools": "7.7.4",
+    "@zuplo/runtime": "7.7.4",
     "chalk": "5.4.1",
     "chokidar": "3.5.3",
     "cookie": "1.0.2",
@@ -43,7 +43,7 @@
     "ignore": "5.3.1",
     "javascript-stringify": "2.1.0",
     "jose": "5.9.2",
-    "js-yaml": "4.3.0",
+    "js-yaml": "4.3.2",
     "jsonc-parser": "3.2.0",
     "jsonpath-plus": "10.3.0",
     "minimatch": "10.2.5",
@@ -62,15 +62,15 @@
     "workerd": "1.20241230.0",
     "yargs": "17.7.2",
     "zod": "4.4.3",
-    "@zuplo/graphql": "7.7.2",
-    "@zuplo/otel": "7.7.2"
+    "@zuplo/graphql": "7.7.4",
+    "@zuplo/otel": "7.7.4"
   },
   "optionalDependencies": {
-    "@zuplo/lint-darwin-arm64": "7.7.2",
-    "@zuplo/lint-darwin-x64": "7.7.2",
-    "@zuplo/lint-linux-x64": "7.7.2",
-    "@zuplo/lint-linux-arm64": "7.7.2",
-    "@zuplo/lint-win32-x64": "7.7.2"
+    "@zuplo/lint-darwin-arm64": "7.7.4",
+    "@zuplo/lint-darwin-x64": "7.7.4",
+    "@zuplo/lint-linux-x64": "7.7.4",
+    "@zuplo/lint-linux-arm64": "7.7.4",
+    "@zuplo/lint-win32-x64": "7.7.4"
   },
   "bundleDependencies": [
     "@inquirer/prompts",