refactor: Bump js-yaml from 4.1.1 to 4.3.2

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Fixes the root js-yaml 4.x copy for these Dependabot security alerts:

Alert	Package	Advisory	Severity	Vulnerable	Patched	Summary
450	js-yaml	GHSA-2883-xcg3-v3hh	high	>= 4.0.0, < 4.3.2	4.3.2	maxTotalMergeKeys does not limit CPU use for empty merge sources
431	js-yaml	GHSA-5p4m-2wfm-xmqj	high	>= 4.0.0, < 4.3.1	4.3.1	Quadratic CPU consumption in !!omap resolution
398	js-yaml	GHSA-52cp-r559-cp3m	high	>= 4.0.0, < 4.3.0	4.3.0	YAML merge-key chains can force quadratic CPU consumption
385	js-yaml	GHSA-h67p-54hq-rp68	medium	>= 4.0.0, <= 4.1.1	4.2.0	Quadratic-complexity DoS in merge key handling via repeated aliases

The dependency is development-only. The nested 3.x copy under @istanbuljs/load-nyc-config was already updated to 3.15.2 in #3451.

Approach

Bumps the transitive dev dependency js-yaml from 4.1.1 to 4.3.2, the latest 4.x release (npm update js-yaml --package-lock-only --ignore-scripts). The change is limited to the lock file.

Lock file changes:

• js-yaml 4.1.1 → 4.3.2: node_modules/js-yaml (dev). Its only dependency, argparse ^2.0.1, is unchanged. npm also adds the package's new funding field.
• The nested node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml 3.15.2 is unchanged.

Usage in this project: the parents of the root copy only load js-yaml lazily, when they read a YAML config file, and none of them reads one in this repository:

• @eslint/eslintrc (through eslint 9.39.2) parses YAML only for legacy .eslintrc.yaml, .eslintrc.yml and .eslintrc files. The repository uses the flat config eslint.config.js and has no .eslintrc* files.
• cosmiconfig (through semantic-release, the nested semantic-release of @saithodev/semantic-release-backmerge, and puppeteer) parses YAML only for YAML config files. semantic-release finds .releaserc.js. .releaserc/ is a folder of .hbs templates, which cosmiconfig skips (EISDIR). There is no .puppeteerrc* file and no release or puppeteer key in package.json.
• webpack-cli has an optional peer dependency on js-yaml for YAML webpack configs. All webpack configs in webpack/ are .js files.
• The YAML files in the repository (.github/dependabot.yml, .github/ISSUE_TEMPLATE/config.yml, .github/workflows/*.yml, docker-compose.uffizzi.yml, .prettierrc) are not read by these tools. ci/CiVersionCheck.mjs parses YAML with the yaml package, not js-yaml.

The parser changes below therefore cannot affect this project.

Changes

• 4.2.0:
  • Security: removes quadratic complexity in merge (<<) by deduplicating repeated elements (GHSA-h67p-54hq-rp68).
  • Adds the maxDepth (100) and maxMergeSeqLength (20) loader options.
  • Numbers with underscores are no longer resolved as numeric scalars (Parsing numbers according to YAML 1.2 nodeca/js-yaml#627).
  • Top-level block scalars without content indentation are now rejected (Loader must throw an error on zero-indentation block scalar nodeca/js-yaml#280).
  • Parser fixes for properties on the first implicit block mapping key ([reader] Reading of properties on implicit block mapping keys. nodeca/js-yaml#62), flow scalar trailing whitespace folding (Example 7.5 "Double Quoted Line Breaks" of the 1.2 spec is not parsed properly nodeca/js-yaml#307), number round-trips (Can't round-trip out-of-range floating point nodeca/js-yaml#737) and digits in named tag handles.
• 4.3.0: Adds the maxTotalMergeKeys (10000) loader option, which limits the total number of keys processed by YAML merge (<<) in one load() / loadAll() call, and replaces maxMergeSeqLength (GHSA-52cp-r559-cp3m). Restores the UMD builds to ES5.
• 4.3.1: Security: removes quadratic complexity from !!omap duplicate key detection (GHSA-5p4m-2wfm-xmqj).
• 4.3.2: Merge sequences are now hard-limited to 100 entries. Security: empty mappings in merge sequences now count toward maxTotalMergeKeys (fix: count empty merge sources against maxTotalMergeKeys nodeca/js-yaml#797, GHSA-2883-xcg3-v3hh).

The package entry points (exports, main, module) and the load() API are unchanged.

Breaking Changes

None. The stricter parsing in 4.2.0 only applies to YAML documents, and none of the parents parses YAML in this repository (see Usage above).

Code Changes Required

None. This is a drop-in replacement.

Tasks

N/A. This is a lock-file-only dependency update.

Summary by CodeRabbit

• Chores
  • Updated the YAML parsing package from version 4.1.1 to 4.3.2. This is a behind-the-scenes maintenance change; no user-facing features or behavior changes are included in this update.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 0df301ce-1a6c-4be7-88de-ca0cff2d9bad

📥 Commits

Reviewing files that changed from the base of the PR and between c3ed2a6 and c294878.

📒 Files selected for processing (1)

• package-lock.json

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The lockfile updates the resolved js-yaml version from 4.1.1 to 4.3.2. It also updates the package URL and integrity hash, and adds funding URLs.

Changes

js-yaml dependency update

Layer / File(s)	Summary
Update js-yaml lock entry package-lock.json	The locked version changes from 4.1.1 to 4.3.2. The package URL and integrity hash are updated, and funding URLs are added.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to c2948

This update resolves the named advisories, and the remaining development dependency is not affected by them. No actionable merge risk is identified.

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title uses the allowed refactor: prefix and clearly describes the js-yaml dependency update. The subject begins with a capitalized word.
Description check	✅ Passed	The description includes the required sections and provides clear issue, security, approach, scope, compatibility, and task details. It is complete for a lock-file-only dependency update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Check	✅ Passed	PASS: The pull request changes only package-lock.json. It replaces the development-only root node_modules/js-yaml entry from 4.1.1 to 4.3.2 and updates the resolved URL and integrity hash. No appl…
Engage In Review Feedback	✅ Passed	No review feedback comments or actionable findings were returned. Therefore, there is no feedback that the contributor failed to engage with, resolve, or discuss.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}