release: 0.1.0-alpha.3 - #17
Conversation
|
🧪 Testing To try out this version of the SDK: Expires at: Fri, 28 Aug 2026 20:57:59 GMT |
d3f964e to
708cfb7
Compare
e4c0464 to
3821374
Compare
3821374 to
07b60d7
Compare
ec8e171 to
fcb42c9
Compare
5dbf6c6 to
8024d24
Compare
2af4752 to
449add5
Compare
56961c6 to
5248e93
Compare
061fa35 to
396e9c6
Compare
396e9c6 to
b742152
Compare
Note that we still want to run tests, as these depend on the metadata.
d8ca386 to
6157955
Compare
| version "4.1.0" | ||
| resolved "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz" | ||
| integrity sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA== | ||
| js-yaml@^4.1.1: |
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 2397 lists a dependency (js-yaml) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. An attacker can supply a YAML document containing a chain of mappings that each merge the previous one via the merge key (<<), causing js-yaml to spend quadratic CPU time while parsing input whose size grows only linearly, resulting in a denial of service.
To resolve this comment:
Check if you are using js-yaml on the CLI.
- If you're affected, upgrade this dependency to at least version 4.3.0 at yarn.lock.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Questions about this issue? Reach out to Product Security in #prodsec-tools.
You can view more details on this finding in the Semgrep AppSec Platform here.
Automated Release PR
0.1.0-alpha.3 (2026-07-29)
Full Changelog: v0.1.0-alpha.2...v0.1.0-alpha.3
Features
Bug Fixes
Chores
actions/checkoutversion (4443a16)Refactors
This pull request is managed by Stainless's GitHub App.
The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.
For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.
🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions