fix(ci): bump js-yaml override to 4.3.0 to clear osv-scan GHSA-52cp-r559-cp3m

osv-scan started failing after js-yaml 4.2.0 (High 7.5, npm dev dep pulled
via the dashboard) entered the OSV database. The fix release is 4.3.0, and
package.json already pins js-yaml via an override, so bump the pin and
mirror the resolved/integrity in package-lock.json for the single
node_modules/js-yaml entry. npm ci --dry-run validates the lockfile

Co-authored-by: Krrish Dholakia <krrish-berri-2@users.noreply.github.com>
This commit is contained in:
Cursor Agent 2026-07-20 22:04:51 +00:00
parent eb27447a1d
commit 6e9d8ca339
No known key found for this signature in database
2 changed files with 4 additions and 4 deletions

View file

@ -8513,9 +8513,9 @@
"license": "MIT"
},
"node_modules/js-yaml": {
"version": "4.2.0",
"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
"integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
"version": "4.3.0",
"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
"integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
"dev": true,
"funding": [
{

View file

@ -91,7 +91,7 @@
},
"overrides": {
"prismjs": "1.30.0",
"js-yaml": "4.2.0",
"js-yaml": "4.3.0",
"glob": "13.0.0",
"minimatch": "10.2.4",
"ws": "8.21.0",