fix(security): bound YAML alias expansion in file-parser (billion-laughs DoS)#5756

Merged

waleedlatif1 merged 3 commits into

worktree-yaml-billion-laughs-fix

Jul 18, 2026

Commits on Jul 18, 2026

fix(security): bound YAML alias expansion in file-parser to prevent DoS
waleedlatif1
committed
harden YAML guard: charge keys + escaping, bound stack, fail closed
waleedlatif1
committed
yaml guard: charge lone surrogates at their escaped length
waleedlatif1
committed