Backport quadratic complexity fix for !!omap

Author: puzrin

CHANGELOG.md

@@ -6,6 +6,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
+## 4.3.1 - 2026-07-31
+### Security
+- [backport] Remove quadratic complexity from `!!omap` duplicate key detection.
+
+
 ## 4.3.0 - 2026-06-27
 ### Added
 - [backport] Added `maxTotalMergeKeys` (10000) loader option to limit the total number of

lib/type/omap.js

@@ -8,7 +8,7 @@ const _toString = Object.prototype.toString
 function resolveYamlOmap (data) {
   if (data === null) return true
 
-  const objectKeys = []
+  const objectKeys = {}
   const object = data
 
   for (let index = 0, length = object.length; index < length; index += 1) {
@@ -27,8 +27,8 @@ function resolveYamlOmap (data) {
 
     if (!pairHasKey) return false
 
-    if (objectKeys.indexOf(pairKey) === -1) objectKeys.push(pairKey)
-    else return false
+    if (_hasOwnProperty.call(objectKeys, pairKey)) return false
+    Object.defineProperty(objectKeys, pairKey, { value: true })
   }
 
   return true

test/spec/yaml-test-suite

@@ -0,0 +1 @@
+Subproject commit da267a5c4782e7361e82889e76c0dc7df0e1e870