fix(deps): bump js-yaml override to ^4.3.1 (GHSA-5p4m-2wfm-xmqj)

[GeiserX]

What

Bumps the js-yaml npm override from ^4.2.0 → ^4.3.1, closing the repo's only open Dependabot alert (#91, high severity).

Why

GHSA-5p4m-2wfm-xmqj — quadratic CPU consumption in !!omap resolution (CVE-2026-59870). Vulnerable range >= 4.0.0, < 4.3.1; patched in 4.3.1.

js-yaml isn't a direct dependency — it arrives transitively (dev scope) and was already pinned by an npm override, but at ^4.2.0, which resolved to 4.3.0 — one patch below the fix. Same stale-override pattern as the recent fast-uri fix (#109), and the same transitive-CVE approach already used for hono, lodash, minimatch, postcss, etc.

Staying on the 4.x line is deliberate: js-yaml@5.x (current latest) is a major outside the ranges the transitive consumers declare.

Change scope

1 line in package.json, 3 in the lockfile (version/resolved/integrity), regenerated with npm install --package-lock-only --ignore-scripts — no node_modules changes, no unrelated dependency churn.

Validation

• 4.3.1 confirmed published; the lockfile integrity matches the registry's published hash for 4.3.1 exactly.
• Dev-only dependency, so no runtime/user-facing surface.
• CI (lint, typecheck, tests, build, CodeQL) is the functional gate.

Summary by CodeRabbit

• Chores
  • Updated the YAML parsing dependency to a newer compatible version.
  • Includes the latest maintenance updates and improvements from the dependency.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: e86eacba-110e-4775-b5ff-7d0d7b9b76b0

📥 Commits

Reviewing files that changed from the base of the PR and between 5780b4c and 90aaa69.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

The js-yaml dependency override in package.json changes from ^4.2.0 to ^4.3.1.

Changes

Dependency Update

Layer / File(s)	Summary
Update js-yaml override package.json	The dependency override changes from ^4.2.0 to ^4.3.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested labels: dependencies, javascript

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the dependency override update and its security purpose.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/js-yaml-ghsa-5p4m

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}