fix(deps): raise the js-yaml floor past GHSA-2883-xcg3-v3hh

[lamemustafa]

Summary

Raise the js-yaml floor past GHSA-2883-xcg3-v3hh. pnpm audit --audit-level high runs inside
Verify extension, a required check, so this advisory blocked every pull request and master
itself.

Unblocks #337 and #343.

Root Cause / Decision Record

high  js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
      vulnerable >=4.0.0 <4.3.2, patched >=4.3.2
      .>eslint>@eslint/eslintrc>js-yaml   (18 paths)
      https://github.com/advisories/GHSA-2883-xcg3-v3hh

Confirmed repository-wide rather than branch-local before doing anything: master fails the same
audit (exit=1). Transitive and dev-only — it reaches this project underneath eslint and nothing
in src/, so no extension bundle is affected.

The pin was already there, and was the vulnerable version. pnpm-workspace.yaml pinned
js-yaml: 4.3.1 exactly. So this landed on a dependency the repository had already chosen to
control: the earlier fix became the next exposure because it was pinned exact.

Raised to ^4.3.2 rather than pinned exact again. A caret is what a security floor wants; an exact
pin is also a ceiling, and the next patch-level advisory in this line would otherwise block every
merge until someone edits the file by hand.

Two things worth recording, because both nearly produced a wrong change.

First, my initial fix added pnpm.overrides to package.json. pnpm 11 no longer reads that
field — it warns and continues, and the audit still fails:

[WARN] The "pnpm" field in package.json is no longer read by pnpm.
       The following keys were ignored: "pnpm.overrides".

Only re-running the audit afterwards caught it. An edit that appears to apply and is silently
ignored is exactly the shape a "verified" fix hides behind.

Second, that block would have been a second copy of an override that already existed in
pnpm-workspace.yaml — the duplicate-of-a-canonical-fact shape this repository's defects keep
taking. Reverted, and the existing pin was raised instead.

Scope

• Runtime: none. Nothing under src/; the package is dev-only and transitive.
• Dependencies: pnpm-workspace.yaml override raised; pnpm-lock.yaml regenerated.
• Tests: none changed. No test asserts a dependency version here.
• Explicitly out of scope: the other exact pins in that overrides block. Several are exact for the
  same reason js-yaml was, and each is a future advisory that will block all merges the same way.
  Not converted wholesale here — that is a deliberate policy change across eleven dependencies,
  and it should be decided rather than smuggled into an unblocking fix.

Pack Workflow Preflight

• pnpm workflow:preflight was run before editing/push, or the skip reason is documented.
• This PR was opened from a Pack branch, not master.
• I checked latest master Pack AGENTS guidance or recorded the stale-guidance warning.
• PR body keeps the required Pack privacy/review/verification checklist visible.

Sanchika Adoption Gate

• If this PR consumes @sanchika/* packages or copied Sanchika guidance, I
  read sanchika/docs/adoption-pack.md in the coordinated parent worktree.
• If this PR consumes Sanchika, it links ComplyEaze and Axal completion evidence
  and records the Sanchika commit or copied guidance used.
• This PR does not import ../sanchika, sanchika/packages/*/src, or parent
  source paths.

Privacy And Data-Flow Impact

• No new browser permissions.
• No new host permissions.
• No new network calls.
• No analytics, telemetry, ads, or session replay.
• No credential, OTP, CAPTCHA, cookie, token, GST file, or taxpayer-data capture.
• Public copy and privacy declarations are updated if behaviour changed. (No behaviour change.)

Sensitive Surface Review

• Current tab / portal target binding is preserved or intentionally changed. (Untouched.)
• Download completion remains evidence-backed and fail-closed. (Untouched.)
• Ambiguous side-effect delivery cannot be reported as confirmed success. (Untouched.)
• Service-worker durability impact is understood and documented. (None — dev dependency.)
• Real taxpayer data, local paths, raw URLs/referrers, and portal HTML are absent from the diff.

Chrome Web Store Impact

• This PR does not expand beyond the existing Chrome Web Store V0 listing unless every gate in docs/PUBLICATION_READINESS.md is checked.
• Full fiscal year remains source-only and excluded from the next packaged Store build until its evidence gates are recorded.
• Store copy, README status, Privacy QA, and reviewer instructions were reviewed if user-facing behavior changed. (No user-facing change.)
• CI ZIP creation, provenance, and protected publishing are treated as release evidence, not manual store-submission sign-off.
• PR title uses Conventional Commits so Release Please can bump Pack after merge.

Verification

• pnpm install --frozen-lockfile
• pnpm audit --audit-level high
• pnpm exec wxt prepare
• pnpm exec prettier --check .
• pnpm exec eslint . --max-warnings 0
• pnpm exec tsc --noEmit
• pnpm exec vitest run
• pnpm exec wxt build
• node scripts/verify-extension-package.mjs .output/chrome-mv3
• pnpm exec wxt zip
• node scripts/verify-extension-zip.mjs
• node scripts/write-release-provenance.mjs
• node scripts/verify-github-release-assets.mjs --tag <tag> --zip <zip> --checksum <sha256> --provenance <json> when release assets exist
• node scripts/publish-chrome-web-store.mjs --zip .output/<zip> --provenance .output/pack-release-provenance.v1.json --publisher-id <id> --dry-run true
• git diff --check
• pnpm review:gate -- --strict-head-review --wait-head-review-ms 180000 before merge/readiness claim; a missing Codex review blocks readiness:

resolved                        js-yaml@4.3.2
pnpm audit --audit-level high   No known vulnerabilities found (exit 0)
pnpm install --frozen-lockfile  exit 0
eslint=0  tsc=0  prettier=0  build=0
Pack WXT extension package verification passed.
 Test Files  175 passed (175)
      Tests  3290 passed (3290)
   Duration  270.03s (tests 94%, import 5%, transform 1%)

The lockfile diff touches js-yaml and nothing else — 2 files, +7 −7. eslint passing is the
load-bearing check, since that is how js-yaml reaches this project.

Artifact Evidence

• CI run: pending on this head.
• ZIP artifact: n/a — dependency resolution only.
• ZIP SHA-256: n/a.
• Clean source/tag or head SHA: 9a7a1ab.

PR Review Follow-Up

• GitHub Actions completed.
• Autogenerated Codex/bot review comments inspected after checks completed for the latest head SHA.
• Inline review threads are resolved, outdated, or answered with evidence.
• No commits were pushed after the last required human/bot review without re-review.
• Any follow-up PRs or issues are listed here instead of being left implicit.

Thread/comment	Disposition	Commit or evidence
none yet	—	9a7a1ab; audit clean, frozen install clean, lockfile diff limited to js-yaml
Other exact pins in the same overrides block	follow-up	Named in Scope; each is a future all-merges block, but converting them is a policy decision

Screenshots

None — dependency resolution change.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T06:35:18.393616Z	9a7a1ab	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.