Issue #57 explicitly required using github.com/goccy/go-yaml v1.16.0 or later, with a documented security rationale:
Use github.com/goccy/go-yaml v1.16.0 or later. Why this library:
Actively maintained (10 releases in the last year, current v1.19.2)
Security issue (AIKIDO-2024-10486, DoS via deep nesting) was fixed promptly in v1.16.0
gopkg.in/yaml.v3 is abandoned (no code changes since May 2022)
PR #58 instead added gopkg.in/yaml.v3 (the abandoned library the issue explicitly rejected). The PR implements the YAML depth defense with MaxYAMLDepth/MaxYAMLNodes constants, but uses the wrong underlying library.
Note: gopkg.in/yaml.v3 has its own YAML parsing quirks and lacks active maintenance. The explicit library choice in the issue was not honored.
Source
PR: #58 — feat: add YAML support for persona files
Linked issue: #57 — Add YAML support for persona files
File: go.mod line containing gopkg.in/yaml.v3 v3.0.1
What needs to happen
Replace gopkg.in/yaml.v3 with github.com/goccy/go-yaml at v1.16.0+
Update review/persona.go import from gopkg.in/yaml.v3 to github.com/goccy/go-yaml
Verify existing YAML tests still pass with the new library
## What was missed
Issue #57 explicitly required using `github.com/goccy/go-yaml` v1.16.0 or later, with a documented security rationale:
> Use `github.com/goccy/go-yaml` v1.16.0 or later.
> **Why this library:**
> - Actively maintained (10 releases in the last year, current v1.19.2)
> - Security issue (AIKIDO-2024-10486, DoS via deep nesting) was fixed promptly in v1.16.0
> - `gopkg.in/yaml.v3` is abandoned (no code changes since May 2022)
PR #58 instead added `gopkg.in/yaml.v3` (the abandoned library the issue explicitly rejected). The PR implements the YAML depth defense with `MaxYAMLDepth`/`MaxYAMLNodes` constants, but uses the wrong underlying library.
Note: `gopkg.in/yaml.v3` has its own YAML parsing quirks and lacks active maintenance. The explicit library choice in the issue was not honored.
## Source
- PR: #58 — feat: add YAML support for persona files
- Linked issue: #57 — Add YAML support for persona files
- File: `go.mod` line containing `gopkg.in/yaml.v3 v3.0.1`
## What needs to happen
- Replace `gopkg.in/yaml.v3` with `github.com/goccy/go-yaml` at v1.16.0+
- Update `review/persona.go` import from `gopkg.in/yaml.v3` to `github.com/goccy/go-yaml`
- Verify existing YAML tests still pass with the new library
- Remove `gopkg.in/yaml.v3` from `go.mod` and `go.sum`
- `go build ./...` and `go test ./...` pass
## References
- [PR #58](https://gitea.weiker.me/rodin/review-bot/pulls/58)
- [Issue #57](https://gitea.weiker.me/rodin/review-bot/issues/57)
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What was missed
Issue #57 explicitly required using
github.com/goccy/go-yamlv1.16.0 or later, with a documented security rationale:PR #58 instead added
gopkg.in/yaml.v3(the abandoned library the issue explicitly rejected). The PR implements the YAML depth defense withMaxYAMLDepth/MaxYAMLNodesconstants, but uses the wrong underlying library.Note:
gopkg.in/yaml.v3has its own YAML parsing quirks and lacks active maintenance. The explicit library choice in the issue was not honored.Source
go.modline containinggopkg.in/yaml.v3 v3.0.1What needs to happen
gopkg.in/yaml.v3withgithub.com/goccy/go-yamlat v1.16.0+review/persona.goimport fromgopkg.in/yaml.v3togithub.com/goccy/go-yamlgopkg.in/yaml.v3fromgo.modandgo.sumgo build ./...andgo test ./...passReferences