Upgrade js-yaml to 4.X (#3623)

src/common/__tests__/cluster-store.test.ts

@@ -426,7 +426,7 @@ describe("pre 2.6.0 config with a cluster that has arrays in auth config", () =>
   it("replaces array format access token and expiry into string", async () => {
     const file = ClusterStore.getInstance().clustersList[0].kubeConfigPath;
     const config = fs.readFileSync(file, "utf8");
-    const kc = yaml.safeLoad(config);
+    const kc = yaml.load(config) as Record<string, any>;
 
     expect(kc.users[0].user["auth-provider"].config["access-token"]).toBe("should be string");
     expect(kc.users[0].user["auth-provider"].config["expiry"]).toBe("should be string");

src/common/k8s-api/endpoints/helm-releases.api.ts

@@ -19,7 +19,7 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
 
-import jsYaml from "js-yaml";
+import yaml from "js-yaml";
 import { autoBind, formatDuration } from "../../utils";
 import capitalize from "lodash/capitalize";
 import { apiBase } from "../index";
@@ -113,21 +113,31 @@ export async function getRelease(name: string, namespace: string): Promise<IRele
 }
 
 export async function createRelease(payload: IReleaseCreatePayload): Promise<IReleaseUpdateDetails> {
-  const { repo, ...data } = payload;
+  const { repo, chart: rawChart, values: rawValues, ...data } = payload;
+  const chart = `${repo}/${rawChart}`;
+  const values = yaml.load(rawValues);
 
-  data.chart = `${repo}/${data.chart}`;
-  data.values = jsYaml.safeLoad(data.values);
-
-  return apiBase.post(endpoint(), { data });
+  return apiBase.post(endpoint(), {
+    data: {
+      chart,
+      values,
+      ...data,
+    }
+  });
 }
 
 export async function updateRelease(name: string, namespace: string, payload: IReleaseUpdatePayload): Promise<IReleaseUpdateDetails> {
-  const { repo, ...data } = payload;
+  const { repo, chart: rawChart, values: rawValues, ...data } = payload;
+  const chart = `${repo}/${rawChart}`;
+  const values = yaml.load(rawValues);
 
-  data.chart = `${repo}/${data.chart}`;
-  data.values = jsYaml.safeLoad(data.values);
-
-  return apiBase.put(endpoint({ name, namespace }), { data });
+  return apiBase.put(endpoint({ name, namespace }), {
+    data: {
+      chart,
+      values,
+      ...data,
+    }
+  });
 }
 
 export async function deleteRelease(name: string, namespace: string): Promise<JsonApiData> {

src/common/k8s-api/endpoints/resource-applier.api.ts

@@ -19,7 +19,7 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
 
-import jsYaml from "js-yaml";
+import yaml from "js-yaml";
 import type { KubeJsonApiData } from "../kube-json-api";
 import { apiBase } from "../index";
 import type { Patch } from "rfc6902";
@@ -30,7 +30,13 @@ export const annotations = [
 
 export async function update(resource: object | string): Promise<KubeJsonApiData> {
   if (typeof resource === "string") {
-    resource = jsYaml.safeLoad(resource);
+    const parsed = yaml.load(resource);
+
+    if (typeof parsed !== "object") {
+      throw new Error("Cannot update resource to string or number");
+    }
+
+    resource = parsed;
   }
 
   return apiBase.post<KubeJsonApiData>("/stack", { data: resource });

src/common/k8s/resource-stack.ts

@@ -133,7 +133,7 @@ export class ResourceStack {
 
       if (!resourceData.trim()) continue;
 
-      const resourceArray = yaml.safeLoadAll(resourceData.toString());
+      const resourceArray = yaml.loadAll(resourceData.toString());
 
       resourceArray.forEach((resource) => {
         if (resource?.metadata) {
@@ -143,7 +143,7 @@ export class ResourceStack {
           resource.metadata.labels["app.kubernetes.io/created-by"] = "resource-stack";
         }
 
-        resources.push(yaml.safeDump(resource));
+        resources.push(yaml.dump(resource));
       });
     }
 

src/common/kube-helpers.ts

@@ -111,7 +111,7 @@ interface OptionsResult {
 }
 
 function loadToOptions(rawYaml: string): OptionsResult {
-  const parsed = yaml.safeLoad(rawYaml);
+  const parsed = yaml.load(rawYaml);
   const { error } = kubeConfigSchema.validate(parsed, {
     abortEarly: false,
     allowUnknown: true,
@@ -248,7 +248,7 @@ export function dumpConfigYaml(kubeConfig: Partial<KubeConfig>): string {
   logger.debug("Dumping KubeConfig:", config);
 
   // skipInvalid: true makes dump ignore undefined values
-  return yaml.safeDump(config, { skipInvalid: true });
+  return yaml.dump(config, { skipInvalid: true });
 }
 
 /**