Permalink
Comparing changes
Choose two branches to see what’s changed or to start a new pull request.
If you need to, you can also or
learn more about diff comparisons.
Open a pull request
Create a new pull request by comparing changes across two branches. If you need to, you can also .
Learn more about diff comparisons here.
...
- 4 commits
- 5 files changed
- 2 contributors
Commits on Aug 26, 2026
-
fix: count empty merge sources against maxTotalMergeKeys (#797)
The maxTotalMergeKeys guard (added for the quadratic merge-key DoS, GHSA-g796-fgmg-93mv) charges the budget once per *folded* key. A merge source that folds no keys — an empty mapping — therefore costs real work but never touches the counter. Aliasing one N-element sequence of empty mappings into K merge targets does O(K*N) work while the guard never fires: arr: &arr [{}, {}, ...] # N empty maps targets: - <<: *arr # x K With merge enabled (YAML11_SCHEMA), an ~500 KB document of this shape takes ~13s to load and scales quadratically, restoring the DoS the guard was meant to prevent; a real key-folding merge of the same size is correctly rejected. Charge one unit for a source that folds no keys, so a sequence of empty mappings is bounded by maxTotalMergeKeys like any other merge. Normal and single empty-map merges are unaffected.
-
-
Loading
This comparison is taking too long to generate.
Unfortunately it looks like we can’t render this comparison for you right now. It might be too big, or there might be something weird with your repository.
You can try running this command locally to see the comparison on your machine:
git diff 5.4.0...5.4.1