refactor: Bump js-yaml from 3.14.2 to 3.15.2

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Closes #3450

Approach

Bumps the transitive dev dependency js-yaml from 3.14.2 to 3.15.2. The change is limited to the lock file. It updates only the nested 3.x copy used by @istanbuljs/load-nyc-config (via jest → babel-plugin-istanbul). The root js-yaml 4.1.1 copy is left unchanged and will be handled in a separate update. This resolves the 3.x security advisories GHSA-2883-xcg3-v3hh, GHSA-5p4m-2wfm-xmqj, GHSA-52cp-r559-cp3m and GHSA-h67p-54hq-rp68. The dependency is development-only.

Changes

• 3.15.0: Added the maxTotalMergeKeys (10000) loader option, which limits the total number of keys processed by YAML merge (<<) in one safeLoad() / safeLoadAll() call
• 3.15.1: Security: removed quadratic complexity from !!omap duplicate key detection
• 3.15.2: Merge sequences are now hard-limited to 100 entries. Security: empty mappings in merge sequences now count toward maxTotalMergeKeys, to limit CPU usage (fix: count empty merge sources against maxTotalMergeKeys nodeca/js-yaml#797)

Breaking Changes

None

Code Changes Required

None. This is a drop-in replacement. @istanbuljs/load-nyc-config only calls load() to parse a .nycrc.yml / .nycrc.yaml file, and this repository has none.

Tasks

N/A. This is a lock-file-only dependency update.

Summary by CodeRabbit

• Chores
  • This release contains behind-the-scenes maintenance only. There are no user-facing changes to product features, workflows, or behavior. Existing functionality remains unchanged.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 564984cc-d3cc-48cc-93e8-6ba4eccae8ae

📥 Commits

Reviewing files that changed from the base of the PR and between 33a37e4 and d341324.

📒 Files selected for processing (1)

• package-lock.json

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The lockfile updates the nested js-yaml dependency from version 3.14.2 to 3.15.2. It also updates the package’s resolved URL and integrity hash.

Changes

js-yaml dependency update

Layer / File(s)	Summary
Update locked js-yaml package package-lock.json	The nested js-yaml entry changes from version 3.14.2 to 3.15.2. The resolved URL and integrity hash also change.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to d3413

The dependency update is mergeable after normal checks; no concrete issue requiring a pre-merge fix is established.

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title begins with the permitted refactor: prefix, uses a capitalized first word after the prefix, and accurately describes the js-yaml dependency update.
Description check	✅ Passed	The description includes the required Pull Request, Issue, Approach, and Tasks sections. It clearly explains the lock-file-only dependency update, affected dependency path, security advisories, and ab…
Linked Issues check	✅ Passed	The PR satisfies issue [#3450]. The reviewed change updates the nested development-only js-yaml dependency in package-lock.json from 3.14.2 to 3.15.2, including its registry URL and integrity …
Out of Scope Changes check	✅ Passed	The reported change is limited to three additions and three removals in package-lock.json. The change updates the dependency requested by issue [#3450]. The root js-yaml 4.1.1 dependency remains…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check	✅ Passed	PASS. The pull request changes only the lockfile and replaces the transitive, development-only js-yaml 3.14.2 record with 3.15.2, including its registry URL and integrity hash. No application code o…
Engage In Review Feedback	✅ Passed	The supplied review result reports zero actionable findings in the current review. Therefore, no current review feedback required engagement, implementation, or reviewer retraction.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[parseplatformorg]

🎉 This change has been released in version 9.3.0-alpha.6