Ensure top-level permissions are not set to write-all
Ensure top-level permissions are not set to write-all on on(Release)
checkov.github/workflows/release.yml:14
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
### Summary
A crafted YAML document can trigger algorithmic CPU exhaustion in `js-yaml` merge-key processing (`<<`) by repeating the same alias many times in a merge sequence.
This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event …
osv-scannerCVE-2026-53550
js-yaml: YAML merge-key chains can force quadratic CPU consumption
### Impact
js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one:
```yaml
a0: &a0 { k0: 0 }
a1: &a1 { <<: *a0, k1: 1 }
a2: &a2 { <<: *a1, k2: 2 }
a3: &a3 {…
osv-scannerCVE-2026-59869
js-yaml: YAML merge-key chains can force quadratic CPU consumption
### Impact
js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one:
```yaml
a0: &a0 { k0: 0 }
a1: &a1 { <<: *a0, k1: 1 }
a2: &a2 { <<: *a1, k2: 2 }
a3: &a3 {…
osv-scannerCVE-2026-59869