Skip to content

yaml: fold merge-key property budget into alias-expansion budget - #32385

Open
robobun wants to merge 4 commits into
mainfrom
farm/9d093b8c/yaml-merge-budget
Open

yaml: fold merge-key property budget into alias-expansion budget#32385
robobun wants to merge 4 commits into
mainfrom
farm/9d093b8c/yaml-merge-budget

yaml: charge merge-key copies against the alias-expansion budget

33ed661
Select commit
Loading
Failed to load commit list.
Claude / Claude Code Review completed Jun 16, 2026 in 22m 51s

Code review found 1 potential issue

Found 4 candidates, confirmed 1. See review comments for details.

Details

Severity Count
🔴 Important 0
🟡 Nit 1
🟣 Pre-existing 0
Severity File:Line Issue
🟡 Nit test/js/bun/yaml/yaml.test.ts:4542-4552 Nested-merge regression test can pass for the wrong reason

Annotations

Check warning on line 4552 in test/js/bun/yaml/yaml.test.ts

See this annotation in the file changed.

@claude claude / Claude Code Review

Nested-merge regression test can pass for the wrong reason

nit: the `.toThrow(/[Ee]xcessive aliasing/)` assertion can pass for the wrong reason — the bomb pre-consumes ~16,759,547 of the 16,777,216 alias-expansion budget via hand-tuned magic numbers (18, 29), leaving only a ~0.1% margin, so any future tweak to `MAX_ALIAS_EXPANSION` or `charge_alias_expansion` node-counting will make `pad:` itself throw before the parser ever reaches the nested `{<<: ...}` section. Add `expect(() => YAML.parse(bomb.join("\n") + "\n")).not.toThrow()` before building `payl