v16.22.1

What's Changed

Bug Fixes

• Shared config parsing is now bounded against YAML alias bombs and circular aliases by @dyoshikawa in #2925
  • parseSharedConfig walks every parsed value while stripping prototype-pollution keys, and a YAML file with nested anchors (an "alias bomb"), a self-referencing anchor, a long string aliased many times, or a very deep alias chain could previously make rulesync import hang, exhaust memory, or overflow the stack. The sanitizer now charges every value, string and key against fixed budgets, caps nesting depth, and refuses a reference back to an ancestor, each with a clear error that names the offending file (closes #2915).

Other Changes

• The value, string-character and depth bookkeeping shared by the frontmatter cleaner and the shared-config sanitizer now lives in one src/utils/bounded-walk.ts utility so the two walks cannot drift apart.
• Homebrew formula updated to v16.22.0 in #2923

Contributors

• @dyoshikawa

Full Changelog

v16.22.0...v16.22.1