fix: remediate js-yaml vulnerability
What changed
Updated the transitive js-yaml dependency from 4.1.1 to 4.3.2 in package-lock.json.
Validation
Repository setting: Agent decides. The agent chooses relevant checks. Observed results are reported below.
Passed npm ci, 44 tests, lint, dependency resolution, audit, and git diff checks. All requested js-yaml advisories are absent; one unrelated brace-expansion advisory remains.
Repository CI: Not yet verified by Mendr. Check this PR’s status checks before merging.
Security context
Remediate the reported vulnerabilities in js-yaml.
Reported advisories: GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, CVE-2026-53550, CVE-2026-59869, CVE-2026-84375
Affected dependency files:
package-lock.json
Independent AI review
The lockfile-only update correctly upgrades the sole js-yaml instance from 4.1.1 to 4.3.2. All four requested advisory ranges are remediated, dependency resolution is consistent, and recorded npm ci, 44 tests, and lint checks passed. Audit reports no js-yaml findings; one unrelated brace-expansion advisory remains.
Execution details
| Recorded results | Exit 0 | Nonzero or unconfirmed |
|---|---|---|
| 23 | 20 | 3 |
These counts include investigation, setup, checks, and cleanup. They are not a test pass rate. Full command output is retained in the Mendr repair record.
Base: f472c2f
Reviewed commit: 53070fd
Repair run: ec3e8aa7-eb7f-48eb-9cd9-25d2e255cc65