DO NOT MERGE but please fix [GHSA-hp87-p4gw-j4gq] Unhandled exception in gopkg.in/yaml.v3

[thediveo]

This is not an improvement PR, do NOT merge it

This is a request to fix the broken GHSA

As there seems to be no other way to deal with a totally broken GitHub CVE, I'm afraid I need to give notice via an improvement request in the hope something hooman notices how messed up this GitHub CVE is ... albeit admittedly based on upstream.

• The affected versions data is wrong, as it does not concern the widely used yaml.v2. This now causes an enormous number of false positives. See v3: panic "attempted to parse unknown event (please report): none" go-yaml/yaml#666 (comment).
• yaml.v3 has (not only) incompatible unmarshalling changes that can silently break a lot of applications trying to upgrade from yaml.v2 to yaml.v3. For instance, at least in some situations the keys of unmarshalled maps change from interface{} to string. This and other API changes require lots of downstream changes, albeit yaml.v2 isn't vulnerable to the DoS attack that makes v3 panic'king.

[dylan-tock]

#350 should handle this. But I would ask the @advisory-database folx to update this ASAP as I have repos that are incorrectly making my security folks farklempt.

[advisory-database]

Hi @thediveo! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

[darakian]

@dylan-tock thanks for the fix PR and sorry all for the error.

@thediveo you're also welcome to make an issue in this repo if a PR isn't what you want to do.