From 90aaa692b5c77c84fc27ac67667e00c812a37f06 Mon Sep 17 00:00:00 2001
From: GeiserX <9169332+GeiserX@users.noreply.github.com>
Date: Sat, 8 Aug 2026 01:06:52 +0200
Subject: [PATCH] fix(deps): bump js-yaml override to ^4.3.1
 (GHSA-5p4m-2wfm-xmqj)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

js-yaml < 4.3.1 has quadratic CPU consumption in !!omap resolution (high,
CVE-2026-59870). It is a transitive dev-only dependency already pinned by an
npm override, but the override was ^4.2.0 which resolved to 4.3.0 — one patch
below the fix.

Bump the override to ^4.3.1 and regenerate the lockfile entry
(npm install --package-lock-only). Staying on the 4.x line keeps transitive
consumers satisfied; 5.x is a major and out of their ranges.

Closes the only open Dependabot alert (#91).
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 1eac8ba..64438c7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8562,9 +8562,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "dev": true,
       "funding": [
         {
diff --git a/package.json b/package.json
index b5ef3f1..a14aa41 100644
--- a/package.json
+++ b/package.json
@@ -68,7 +68,7 @@
     "postcss": "^8.5.23",
     "sharp": "^0.35.3",
     "esbuild": "^0.28.1",
-    "js-yaml": "^4.2.0",
+    "js-yaml": "^4.3.1",
     "@babel/core": "^7.29.6",
     "jsdom": {
       "undici": "^7.28.0"