[RandomByte]

Project loading read ui5.yaml, manifest.json, manifest.appdescr_variant and build-manifest.json and passed them to js-yaml, AJV, JSON.parse and structuredClone with no size, collection or nesting bound. Oversized or deeply nested inputs consumed unbounded parsing and validation resources.

Enforce finite, configurable limits before parsing, validation, defaults processing or cloning:

• Byte size of ui5.yaml and of each manifest, checked from file metadata before the content is read. The ui5.yaml budget covers every YAML document in the file.
• YAML nesting, through an explicit js-yaml maxDepth option. The parser default of 100 was previously implicit.
• JSON nesting, through a string scan before JSON.parse that skips brackets inside strings and handles escapes.
• Collection size, the entries in any one array or properties in any one object, checked after parsing and before validation.

Limits default to generous values and accept overrides through UI5_CONFIG_MAX_BYTES, UI5_MANIFEST_MAX_BYTES, UI5_CONFIG_MAX_DEPTH, UI5_JSON_MAX_DEPTH and UI5_CONFIG_MAX_COLLECTION. Each failure is a handled error that names the input and the exceeded limit, with a stable code (ERR_CONFIG_TOO_LARGE, ERR_CONFIG_TOO_DEEP,
ERR_CONFIG_COLLECTION_TOO_LARGE, ERR_CONFIG_INVALID_LIMIT).

Per-document limits do not bound a graph assembled from many dependency documents. CI jobs and containers building untrusted projects must still set process and container resource limits. The Configuration documentation describes the settings and their defaults.