From d0d7a9e58801f1ba63af4c7cceac26db4789bf6b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 10 Aug 2026 18:09:40 +0000
Subject: [PATCH] Bump transitive js-yaml to >=4.3.1 to fix CVE-2026-59870

Co-authored-by: JoyceZhu <6251669+JoyceZhu@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 package.json      | 5 ++++-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index a893090..2bfa74f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -235,9 +235,9 @@
       }
     },
     "node_modules/@eslint/eslintrc/node_modules/js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "dev": true,
       "funding": [
         {
diff --git a/package.json b/package.json
index 9498366..204c244 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,10 @@
     "vitest": "^4.1.9"
   },
   "overrides": {
-    "postcss": "8.5.23"
+    "postcss": "8.5.23",
+    "@eslint/eslintrc": {
+      "js-yaml": "^4.3.1"
+    }
   },
   "repository": {
     "type": "git",