refactor: Bump yaml from 2.8.3 to 2.9.0

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Closes #10597

This PR replaces the original Dependabot pull request #10597. Dependabot branches live in the upstream repository and cannot be modified directly, so the update is re-created here from a fork to allow the branch to be rebased and re-run against CI.

Approach

Bumps the yaml development dependency from 2.8.3 to 2.9.0.

yaml is a devDependency only. It is used by the CI tooling in ci/CiVersionCheck.js, which reads the GitHub Actions workflow YAML files and parses them (yaml.parse) to verify that the Node.js, MongoDB and PostgreSQL versions declared in the CI matrix stay in sync with the versions supported by Parse Server. It is not part of the published package runtime and has no effect on Parse Server's public API.

Upstream changes included in this bump (2.8.4 and 2.9.0):

• 2.9.0 — fix: avoid calling Array.prototype.push.apply() with a large source array.
• 2.9.0 — fix(lexer): avoid recursive calls that may exhaust the call stack.
• 2.9.0 — documentation change only: the claim that parseDocument() and parseAllDocuments() "never throw" has been removed; upstream will from now on treat call-stack-exhaustion errors triggered by malicious input as ordinary bugs rather than security vulnerabilities. This is a policy and docs change upstream, not an API change.
• 2.8.4 — fix: disable alias resolution with maxAliasCount: 0; handle invalid unicode escapes; apply minFractionDigits only to decimal strings.

No breaking changes are documented for this range, and none of the fixed behaviours are relied upon by the CI version check.

Scope of the diff: only package.json and package-lock.json are touched. The lockfile churn is confined to the yaml subtree (the version, resolved URL and integrity hash of the yaml entries); no other dependency, transitive tree or lockfile section is modified.

Tasks

• Reviewed the upstream changelog for breaking changes between 2.8.3 and 2.9.0; none apply to this bump.

No new tests and no documentation changes are required: this is a version-only bump of a development dependency and contains no changes to Parse Server source code, behaviour or public API.

Summary by CodeRabbit

• Chores
  • Updated the YAML development dependency to version 2.9.0.
  • Refreshed the locked dependency metadata to keep installations consistent.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8dd3c13d-a8af-4f13-9eef-f3f2321e11b7

📥 Commits

Reviewing files that changed from the base of the PR and between 17682fe and 68476e2.

📒 Files selected for processing (2)

• package-lock.json
• package.json

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

The pull request upgrades the yaml development dependency from 2.8.3 to 2.9.0 and updates the corresponding lockfile metadata.

Changes

YAML dependency upgrade

Layer / File(s)	Summary
Update YAML version and lock metadata package.json, package-lock.json	The development dependency, lock entries, registry URLs, and integrity hashes now reference yaml version 2.9.0.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 68476

This PR only updates a development dependency and its lockfile entry, without changing published runtime behavior or the public API; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: semantic-release-bot

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title begins with the allowed refactor: prefix and clearly describes the yaml dependency update. The first word after the prefix is capitalized.
Description check	✅ Passed	The description includes the required Pull Request, Issue, Approach, and Tasks sections. It explains the dependency update, scope, upstream changes, and testing/documentation rationale.
Linked Issues check	✅ Passed	The changes satisfy issue #10597 by updating yaml from 2.8.3 to 2.9.0 in package.json and package-lock.json. The described upstream fixes and documentation clarification are consistent with the …
Out of Scope Changes check	✅ Passed	The changes are limited to the requested yaml dependency update in package.json and its corresponding lockfile entries. No unrelated code or dependency changes are present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check	✅ Passed	PASS — The exact PR commit changes only package.json and package-lock.json, and upgrades yaml from 2.8.3 to 2.9.0. The dependency is a devDependency; both lockfile records have dev: true…
Engage In Review Feedback	✅ Passed	No review feedback required engagement. The checked PR is #10625, whose GitHub API data shows 0 submitted reviews and 0 inline review comments. Its issue comments are automated status/review messages;…

Full details: Linked Issues check

Explanation

The changes satisfy issue #10597 by updating yaml from 2.8.3 to 2.9.0 in package.json and package-lock.json. The described upstream fixes and documentation clarification are consistent with the requested version range.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Full details: Security Check

Explanation

PASS — The exact PR commit changes only package.json and package-lock.json, and upgrades yaml from 2.8.3 to 2.9.0. The dependency is a devDependency; both lockfile records have dev: true, and the only source import is ci/CiVersionCheck.js. GitHub advisories report vulnerable ranges below 2.8.3 and below 2.2.2, so 2.9.0 is outside both ranges. The published 2.9.0 package also replaces large-array push.apply() and recursive lexer paths and adds the alias-resolution limit guard. No changed code pattern introduces a stated security vulnerability.

Full details: Engage In Review Feedback

Explanation

No review feedback required engagement. The checked PR is #10625, whose GitHub API data shows 0 submitted reviews and 0 inline review comments. Its issue comments are automated status/review messages; CodeRabbit reported no actionable comments, and the author only requested a review. The original Dependabot PR #10597 also has 0 submitted reviews and 0 inline comments. Therefore, no feedback was ignored or resolved without discussion.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.79%. Comparing base (f261957) to head (68476e2).
⚠️ Report is 2 commits behind head on alpha.

Additional details and impacted files

@@            Coverage Diff             @@
##            alpha   #10625      +/-   ##
==========================================
+ Coverage   93.78%   93.79%   +0.01%     
==========================================
  Files         192      192              
  Lines       16834    16834              
  Branches      248      248              
==========================================
+ Hits        15788    15790       +2     
+ Misses       1025     1023       -2     
  Partials       21       21              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mtrezza]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

No files to review.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[mtrezza]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.