Robin Newhouse 8e5be3f648 fix: use JSON_SCHEMA for yaml.load to prevent unsafe deserialization (#9500) ...

* fix: use JSON_SCHEMA for yaml.load to prevent unsafe deserialization

Add { schema: yaml.JSON_SCHEMA } to both yaml.load() calls to reject
custom YAML tags (e.g. !!js/function) that could enable code execution
from untrusted .clinerules or skills files.

Add security tests verifying custom tags are rejected.

* add changeset

2026-02-26 14:48:58 -08:00

..

patterns

feat(evals): comprehensive LLM evaluation framework with CI (#8909)

2026-02-12 22:23:35 -06:00

src

fix: use JSON_SCHEMA for yaml.load to prevent unsafe deserialization (#9500)

2026-02-26 14:48:58 -08:00

package-lock.json

feat(evals): comprehensive LLM evaluation framework with CI (#8909)

2026-02-12 22:23:35 -06:00

package.json

feat(evals): comprehensive LLM evaluation framework with CI (#8909)

2026-02-12 22:23:35 -06:00

tsconfig.json

feat(evals): comprehensive LLM evaluation framework with CI (#8909)

2026-02-12 22:23:35 -06:00