Bump js-yaml from 3.13.1 to 4.1.1 in /script/sync-ghes #3109

dependabot · 2025-11-16T21:43:11Z

Bumps js-yaml from 3.13.1 to 4.1.1.

Changelog

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

Types are now exported as yaml.types.XXX.

Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

Check migration guide to see details for all breaking changes.

Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.

Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.

yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.

yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.

!!binary now always mapped to Uint8Array on load.

Reduced nesting of /lib folder.

Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).

dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.

Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.

Code snippet created in exceptions now contains multiple lines with line numbers.

dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.

dump() with skipInvalid=true now serializes invalid items in collections as null.

Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.

Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

Added .mjs (es modules) support.

Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.

Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

Added replacer option (similar to option in JSON.stringify), #339.

Custom Tag can now handle all tags or multiple tags with the same prefix, #385.

Fixed

... (truncated)

Commits

cc482e7 4.1.1 released
50968b8 dist rebuild
d092d86 lint fix
383665f fix prototype pollution in merge (<<)
0d3ca7a README.md: HTTP => HTTPS (#678)
49baadd doc: 'empty' style option for !!null
ba3460e Fix demo link (#618)
2cef47b 4.1.0 released
810b149 dist rebuild
2b5620e Export built-in types, type override now preserves order
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.13.1 to 4.1.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.13.1...4.1.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>

mameenk24 · 2025-12-18T22:15:48Z

This workflow uses actions that are not certified by GitHub.

They are provided by a third-party and are governed by

separate terms of service, privacy policy, and support

documentation.

ev-max2024

Good

diogojoaquim

(https://github.com/user-attachments/assets/1e22a022-7aa0-4c80-bf34-50588b644bb4)

Gulampk · 2025-12-19T07:15:13Z

+966559603906 open Whatsapp account automatically thanks

alisyapm110-gif · 2025-12-30T21:58:54Z

#!/usr/bin/env bash

destroy_github_all.sh

- Dry-run by default: daftar semua resource yang akan dihapus.

- Untuk benar-benar menjalankan penghapusan, atur EXECUTE="YES_I_UNDERSTAND_DELETE_PERMANENTLY"

- Requires: curl, jq

Usage (dry-run):

GITHUB_TOKEN="ghp_xxx" ./destroy_github_all.sh

To perform destructive actions:

GITHUB_TOKEN="ghp_xxx" EXECUTE="YES_I_UNDERSTAND_DELETE_PERMANENTLY" ./destroy_github_all.sh

set -euo pipefail

Safety checks

if ! command -v curl >/dev/null 2>&1; then
echo "Error: curl diperlukan. Install curl dan ulangi." >&2
exit 2
fi
if ! command -v jq >/dev/null 2>&1; then
echo "Error: jq diperlukan. Install jq dan ulangi." >&2
exit 2
fi

: "${GITHUB_TOKEN:?GITHUB_TOKEN environment variable must be set (PAT with appropriate scopes)}"

API="https://api.github.com"
AUTH_HEADER="Authorization: token ${GITHUB_TOKEN}"
PER_PAGE=100

Execution guard: must set EXECUTE env to the exact phrase to actually delete.

EXECUTE="${EXECUTE:-}"
EXECUTE_PHRASE="YES_I_UNDERSTAND_DELETE_PERMANENTLY"

is_execute_run() {
[ "$EXECUTE" = "$EXECUTE_PHRASE" ]
}

echo "===== GitHub Mass-Delete Script (dry-run by default) ====="
echo "This script will operate on resources your token has permission to modify."
echo "If you REALLY want to proceed with permanent deletion, set:"
echo " EXECUTE="$EXECUTE_PHRASE""
echo

Helper: paginated GET

paged_get() {
local url="$1"
local page=1
while :; do
resp=$(curl -sS -H "$AUTH_HEADER" "$url&per_page=$PER_PAGE&page=$page")
if [ "$(echo "$resp" | jq 'length')" -eq 0 ]; then
break
fi
echo "$resp"
page=$((page+1))
done
}

1) List user info (for safety)

user_login=$(curl -sS -H "$AUTH_HEADER" "$API/user" | jq -r .login)
if [ "$user_login" = "null" ] || [ -z "$user_login" ]; then
echo "Gagal mengambil informasi user. Periksa token." >&2
exit 3
fi
echo "Authenticated as: $user_login"
echo

Confirm interactive prompt before any destructive run (extra guard)

if is_execute_run; then
echo "EXECUTION MODE: WILL PERFORM DELETES (permanent)."
echo "FINAL CHECK: Ketik nama akun Anda EXACTLY untuk melanjutkan: $user_login"
read -r confirmname
if [ "$confirmname" != "$user_login" ]; then
echo "Nama tidak cocok. Dibatalkan."
exit 1
fi
else
echo "DRY-RUN mode: tidak akan melakukan penghapusan. Untuk mengaktifkan penghapusan, set EXECUTE to $EXECUTE_PHRASE"
echo
fi

FUNCTIONS TO COLLECT AND (optionally) DELETE

Delete repositories owned by the authenticated user

handle_repos() {
echo "=== Checking repositories owned by $user_login ==="
repos_json=$(curl -sS -H "$AUTH_HEADER" "$API/user/repos?type=owner&per_page=$PER_PAGE")
repos=$(echo "$repos_json" | jq -r '.[].full_name')
if [ -z "$repos" ]; then
echo "(no owner repos found)"
return
fi

echo "Repositories found (owner):"
echo "$repos" | sed 's/^/ - /'
echo

if is_execute_run; then
for r in $repos; do
echo "Deleting repository: $r"
resp_code=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE -H "$AUTH_HEADER" "$API/repos/$r")
if [ "$resp_code" -eq 204 ]; then
echo " OK: $r deleted"
else
echo " WARNING: Failed to delete $r, HTTP $resp_code"
fi
done
fi
}

Delete gists

handle_gists() {
echo "=== Checking Gists ==="
gists_json=$(curl -sS -H "$AUTH_HEADER" "$API/gists?per_page=$PER_PAGE")
gist_ids=$(echo "$gists_json" | jq -r '.[].id')
if [ -z "$gist_ids" ]; then
echo "(no gists found)"
return
fi
echo "Gists found:"
echo "$gist_ids" | sed 's/^/ - /'
echo
if is_execute_run; then
for gid in $gist_ids; do
echo "Deleting gist $gid"
resp_code=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE -H "$AUTH_HEADER" "$API/gists/$gid")
if [ "$resp_code" -eq 204 ]; then
echo " OK: gist $gid deleted"
else
echo " WARNING: Failed to delete gist $gid, HTTP $resp_code"
fi
done
fi
}

Delete public SSH keys for authenticated user

handle_user_keys() {
echo "=== Checking SSH public keys for user ==="
keys_json=$(curl -sS -H "$AUTH_HEADER" "$API/user/keys")
key_ids=$(echo "$keys_json" | jq -r '.[].id')
if [ -z "$key_ids" ]; then
echo "(no user SSH keys found)"
return
fi
echo "User SSH key IDs:"
echo "$key_ids" | sed 's/^/ - /'
echo
if is_execute_run; then
for kid in $key_ids; do
echo "Deleting SSH key id=$kid"
resp_code=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE -H "$AUTH_HEADER" "$API/user/keys/$kid")
if [ "$resp_code" -eq 204 ]; then
echo " OK: key $kid deleted"
else
echo " WARNING: Failed to delete key $kid, HTTP $resp_code"
fi
done
fi
}

For each repo: delete deploy keys, webhooks, secrets, releases, artifacts

handle_repo_level() {
echo "=== Scanning each owner repo for deploy-keys, webhooks, secrets and releases ==="
repos_json=$(curl -sS -H "$AUTH_HEADER" "$API/user/repos?type=owner&per_page=$PER_PAGE")
repos=$(echo "$repos_json" | jq -r '.[].full_name')
if [ -z "$repos" ]; then
echo "(no owner repos found)"
return
fi
for r in $repos; do
owner=$(echo "$r" | cut -d'/' -f1)
repo=$(echo "$r" | cut -d'/' -f2)
echo "-> Repo: $r"

# Deploy keys
dk_json=$(curl -sS -H "$AUTH_HEADER" "$API/repos/$owner/$repo/keys")
dk_ids=$(echo "$dk_json" | jq -r '.[].id')
if [ -n "$dk_ids" ]; then
  echo "   Deploy keys:"
  echo "$dk_ids" | sed 's/^/    - /'
  if is_execute_run; then
    for id in $dk_ids; do
      echo "    Deleting deploy key $id"
      resp_code=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE -H "$AUTH_HEADER" "$API/repos/$owner/$repo/keys/$id")
      [ "$resp_code" -eq 204 ] && echo "      OK" || echo "      WARN HTTP $resp_code"
    done
  fi
fi

# Webhooks (hooks)
hooks_json=$(curl -sS -H "$AUTH_HEADER" "$API/repos/$owner/$repo/hooks")
hook_ids=$(echo "$hooks_json" | jq -r '.[].id')
if [ -n "$hook_ids" ]; then
  echo "   Webhooks:"
  echo "$hook_ids" | sed 's/^/    - /'
  if is_execute_run; then
    for hid in $hook_ids; do
      echo "    Deleting hook $hid"
      resp_code=$(curl -s -o /dev

alisyapm110-gif · 2025-12-30T21:59:04Z

#!/usr/bin/env bash

destroy_github_all.sh

- Dry-run by default: daftar semua resource yang akan dihapus.

- Untuk benar-benar menjalankan penghapusan, atur EXECUTE="YES_I_UNDERSTAND_DELETE_PERMANENTLY"

- Requires: curl, jq

Usage (dry-run):

GITHUB_TOKEN="ghp_xxx" ./destroy_github_all.sh

To perform destructive actions:

GITHUB_TOKEN="ghp_xxx" EXECUTE="YES_I_UNDERSTAND_DELETE_PERMANENTLY" ./destroy_github_all.sh

set -euo pipefail

Safety checks

if ! command -v curl >/dev/null 2>&1; then
echo "Error: curl diperlukan. Install curl dan ulangi." >&2
exit 2
fi
if ! command -v jq >/dev/null 2>&1; then
echo "Error: jq diperlukan. Install jq dan ulangi." >&2
exit 2
fi

: "${GITHUB_TOKEN:?GITHUB_TOKEN environment variable must be set (PAT with appropriate scopes)}"

API="https://api.github.com"
AUTH_HEADER="Authorization: token ${GITHUB_TOKEN}"
PER_PAGE=100

Execution guard: must set EXECUTE env to the exact phrase to actually delete.

EXECUTE="${EXECUTE:-}"
EXECUTE_PHRASE="YES_I_UNDERSTAND_DELETE_PERMANENTLY"

is_execute_run() {
[ "$EXECUTE" = "$EXECUTE_PHRASE" ]
}

echo "===== GitHub Mass-Delete Script (dry-run by default) ====="
echo "This script will operate on resources your token has permission to modify."
echo "If you REALLY want to proceed with permanent deletion, set:"
echo " EXECUTE="$EXECUTE_PHRASE""
echo

Helper: paginated GET

paged_get() {
local url="$1"
local page=1
while :; do
resp=$(curl -sS -H "$AUTH_HEADER" "$url&per_page=$PER_PAGE&page=$page")
if [ "$(echo "$resp" | jq 'length')" -eq 0 ]; then
break
fi
echo "$resp"
page=$((page+1))
done
}

1) List user info (for safety)

user_login=$(curl -sS -H "$AUTH_HEADER" "$API/user" | jq -r .login)
if [ "$user_login" = "null" ] || [ -z "$user_login" ]; then
echo "Gagal mengambil informasi user. Periksa token." >&2
exit 3
fi
echo "Authenticated as: $user_login"
echo

Confirm interactive prompt before any destructive run (extra guard)

if is_execute_run; then
echo "EXECUTION MODE: WILL PERFORM DELETES (permanent)."
echo "FINAL CHECK: Ketik nama akun Anda EXACTLY untuk melanjutkan: $user_login"
read -r confirmname
if [ "$confirmname" != "$user_login" ]; then
echo "Nama tidak cocok. Dibatalkan."
exit 1
fi
else
echo "DRY-RUN mode: tidak akan melakukan penghapusan. Untuk mengaktifkan penghapusan, set EXECUTE to $EXECUTE_PHRASE"
echo
fi

FUNCTIONS TO COLLECT AND (optionally) DELETE

Delete repositories owned by the authenticated user

handle_repos() {
echo "=== Checking repositories owned by $user_login ==="
repos_json=$(curl -sS -H "$AUTH_HEADER" "$API/user/repos?type=owner&per_page=$PER_PAGE")
repos=$(echo "$repos_json" | jq -r '.[].full_name')
if [ -z "$repos" ]; then
echo "(no owner repos found)"
return
fi

echo "Repositories found (owner):"
echo "$repos" | sed 's/^/ - /'
echo

if is_execute_run; then
for r in $repos; do
echo "Deleting repository: $r"
resp_code=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE -H "$AUTH_HEADER" "$API/repos/$r")
if [ "$resp_code" -eq 204 ]; then
echo " OK: $r deleted"
else
echo " WARNING: Failed to delete $r, HTTP $resp_code"
fi
done
fi
}

Delete gists

handle_gists() {
echo "=== Checking Gists ==="
gists_json=$(curl -sS -H "$AUTH_HEADER" "$API/gists?per_page=$PER_PAGE")
gist_ids=$(echo "$gists_json" | jq -r '.[].id')
if [ -z "$gist_ids" ]; then
echo "(no gists found)"
return
fi
echo "Gists found:"
echo "$gist_ids" | sed 's/^/ - /'
echo
if is_execute_run; then
for gid in $gist_ids; do
echo "Deleting gist $gid"
resp_code=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE -H "$AUTH_HEADER" "$API/gists/$gid")
if [ "$resp_code" -eq 204 ]; then
echo " OK: gist $gid deleted"
else
echo " WARNING: Failed to delete gist $gid, HTTP $resp_code"
fi
done
fi
}

Delete public SSH keys for authenticated user

handle_user_keys() {
echo "=== Checking SSH public keys for user ==="
keys_json=$(curl -sS -H "$AUTH_HEADER" "$API/user/keys")
key_ids=$(echo "$keys_json" | jq -r '.[].id')
if [ -z "$key_ids" ]; then
echo "(no user SSH keys found)"
return
fi
echo "User SSH key IDs:"
echo "$key_ids" | sed 's/^/ - /'
echo
if is_execute_run; then
for kid in $key_ids; do
echo "Deleting SSH key id=$kid"
resp_code=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE -H "$AUTH_HEADER" "$API/user/keys/$kid")
if [ "$resp_code" -eq 204 ]; then
echo " OK: key $kid deleted"
else
echo " WARNING: Failed to delete key $kid, HTTP $resp_code"
fi
done
fi
}

For each repo: delete deploy keys, webhooks, secrets, releases, artifacts

handle_repo_level() {
echo "=== Scanning each owner repo for deploy-keys, webhooks, secrets and releases ==="
repos_json=$(curl -sS -H "$AUTH_HEADER" "$API/user/repos?type=owner&per_page=$PER_PAGE")
repos=$(echo "$repos_json" | jq -r '.[].full_name')
if [ -z "$repos" ]; then
echo "(no owner repos found)"
return
fi
for r in $repos; do
owner=$(echo "$r" | cut -d'/' -f1)
repo=$(echo "$r" | cut -d'/' -f2)
echo "-> Repo: $r"

# Deploy keys
dk_json=$(curl -sS -H "$AUTH_HEADER" "$API/repos/$owner/$repo/keys")
dk_ids=$(echo "$dk_json" | jq -r '.[].id')
if [ -n "$dk_ids" ]; then
  echo "   Deploy keys:"
  echo "$dk_ids" | sed 's/^/    - /'
  if is_execute_run; then
    for id in $dk_ids; do
      echo "    Deleting deploy key $id"
      resp_code=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE -H "$AUTH_HEADER" "$API/repos/$owner/$repo/keys/$id")
      [ "$resp_code" -eq 204 ] && echo "      OK" || echo "      WARN HTTP $resp_code"
    done
  fi
fi

# Webhooks (hooks)
hooks_json=$(curl -sS -H "$AUTH_HEADER" "$API/repos/$owner/$repo/hooks")
hook_ids=$(echo "$hooks_json" | jq -r '.[].id')
if [ -n "$hook_ids" ]; then
  echo "   Webhooks:"
  echo "$hook_ids" | sed 's/^/    - /'
  if is_execute_run; then
    for hid in $hook_ids; do
      echo "    Deleting hook $hid"
      resp_code=$(curl -s -o /dev

alisyapm110-gif · 2025-12-30T21:59:27Z

https://github.com/actions/starter-workflows.git

dependabot bot added dependencies Pull requests that update a dependency file javascript labels Nov 16, 2025

dependabot bot requested review from a team as code owners November 16, 2025 21:43

dependabot bot added javascript dependencies Pull requests that update a dependency file labels Nov 16, 2025

ev-max2024 approved these changes Dec 19, 2025

View reviewed changes

diogojoaquim reviewed Dec 19, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump js-yaml from 3.13.1 to 4.1.1 in /script/sync-ghes #3109

Bump js-yaml from 3.13.1 to 4.1.1 in /script/sync-ghes #3109

Uh oh!

dependabot bot commented on behalf of github Nov 16, 2025

Uh oh!

mameenk24 commented Dec 18, 2025

Uh oh!

ev-max2024 left a comment

Uh oh!

diogojoaquim left a comment

Uh oh!

Gulampk commented Dec 19, 2025

Uh oh!

alisyapm110-gif commented Dec 30, 2025

Uh oh!

alisyapm110-gif commented Dec 30, 2025

Uh oh!

alisyapm110-gif commented Dec 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Bump js-yaml from 3.13.1 to 4.1.1 in /script/sync-ghes #3109

Are you sure you want to change the base?

Bump js-yaml from 3.13.1 to 4.1.1 in /script/sync-ghes #3109

Uh oh!

Conversation

dependabot bot commented on behalf of github Nov 16, 2025

[4.1.1] - 2025-11-12

Security

[4.1.0] - 2021-04-15

Added

Changed

[4.0.0] - 2021-01-03

Changed

Added

Fixed

Uh oh!

mameenk24 commented Dec 18, 2025

This workflow uses actions that are not certified by GitHub.

They are provided by a third-party and are governed by

separate terms of service, privacy policy, and support

documentation.

Uh oh!

ev-max2024 left a comment

Choose a reason for hiding this comment

Uh oh!

diogojoaquim left a comment

Choose a reason for hiding this comment

Uh oh!

Gulampk commented Dec 19, 2025

Uh oh!

alisyapm110-gif commented Dec 30, 2025

destroy_github_all.sh

- Dry-run by default: daftar semua resource yang akan dihapus.

- Untuk benar-benar menjalankan penghapusan, atur EXECUTE="YES_I_UNDERSTAND_DELETE_PERMANENTLY"

- Requires: curl, jq

Usage (dry-run):

GITHUB_TOKEN="ghp_xxx" ./destroy_github_all.sh

To perform destructive actions:

GITHUB_TOKEN="ghp_xxx" EXECUTE="YES_I_UNDERSTAND_DELETE_PERMANENTLY" ./destroy_github_all.sh

Safety checks

Execution guard: must set EXECUTE env to the exact phrase to actually delete.

Helper: paginated GET

1) List user info (for safety)

Confirm interactive prompt before any destructive run (extra guard)

FUNCTIONS TO COLLECT AND (optionally) DELETE

Delete repositories owned by the authenticated user

Delete gists

Delete public SSH keys for authenticated user

For each repo: delete deploy keys, webhooks, secrets, releases, artifacts

Uh oh!

alisyapm110-gif commented Dec 30, 2025

destroy_github_all.sh

- Dry-run by default: daftar semua resource yang akan dihapus.

- Untuk benar-benar menjalankan penghapusan, atur EXECUTE="YES_I_UNDERSTAND_DELETE_PERMANENTLY"

- Requires: curl, jq

Usage (dry-run):

GITHUB_TOKEN="ghp_xxx" ./destroy_github_all.sh

To perform destructive actions:

GITHUB_TOKEN="ghp_xxx" EXECUTE="YES_I_UNDERSTAND_DELETE_PERMANENTLY" ./destroy_github_all.sh

Safety checks

Execution guard: must set EXECUTE env to the exact phrase to actually delete.

Helper: paginated GET

1) List user info (for safety)

Confirm interactive prompt before any destructive run (extra guard)

FUNCTIONS TO COLLECT AND (optionally) DELETE

Delete repositories owned by the authenticated user

Delete gists

Delete public SSH keys for authenticated user

For each repo: delete deploy keys, webhooks, secrets, releases, artifacts

Uh oh!

alisyapm110-gif commented Dec 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants