fix(FFESUPPORT-883): remediate July 2026 dependabot vulnerabilities

[aarsilv]

🤖 Generated from Claude

Remediates the 3 open Dependabot alerts in node-server-sdk — all dev-only transitive dependencies. Jira: https://datadoghq.atlassian.net/browse/FFESUPPORT-883

Advisories closed

Advisory	Severity	Package	Before → After	Pulled via
GHSA-h67p-54hq-rp68	medium	js-yaml	3.14.2 → 3.15.0	jest → @istanbuljs/load-nyc-config
GHSA-h67p-54hq-rp68	medium	js-yaml	4.1.1 → 4.3.0	eslint@8 + @microsoft/api-documenter
GHSA-4x5r-pxfx-6jf8	low	@babel/core	7.29.0 → 7.29.7	jest / ts-jest

Approach

Mostly a lockfile-only re-resolution to patched in-range versions. One scoped resolution was required: @microsoft/api-documenter pins js-yaml ~4.1.0 (capped at the vulnerable 4.1.x) even at its latest release (7.30.8), so there is no consumable upstream fix for that path — "@microsoft/api-documenter/js-yaml": "^4.2.0" forces it to 4.3.0. It's a dev-only doc-gen tool and js-yaml's 4.x API is stable across minors; the rationale is recorded in resolutionRationales. No runtime/prod dependency moved.

How the tests/CI protect this change

• yarn install --frozen-lockfile passes → lockfile consistent with package.json.
• yarn typecheck ✓, eslint '**/*.{ts,tsx}' ✓ (eslint parses YAML config via js-yaml — a bad bump fails here).
• yarn test:unit — 115 tests / 2 suites pass (jest via @babel/core; yarn docs / API Extractor also runs api-documenter → js-yaml at install).
• CI runs across the Node 20/22/24 matrix.

Deferred advisories

None — all 3 open Dependabot alerts are addressed; none left dismissed/auto-dismissed.

[Copilot]

Pull request overview

Updates dev-only transitive dependencies to remediate Dependabot-reported vulnerabilities, primarily by re-resolving the Yarn v1 lockfile and adding a targeted Yarn resolutions override for the @microsoft/api-documenter → js-yaml constraint.

Changes:

• Bumps the Babel toolchain dependency set in yarn.lock to @babel/core@7.29.7 (and associated @babel/* packages as resolved).
• Updates js-yaml resolutions in yarn.lock to patched versions (3.15.0 for ^3.13.1 and 4.3.0 for ^4.1.0/~4.1.0 paths).
• Adds a scoped Yarn resolution and rationale to force @microsoft/api-documenter off js-yaml ~4.1.0 and onto a patched js-yaml 4.x version.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
yarn.lock	Re-resolves transitive dev dependencies to patched versions (notably @babel/core and js-yaml).
package.json	Adds a scoped resolutions override and corresponding resolutionRationales entry for @microsoft/api-documenter/js-yaml.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[aarsilv]

🤖 Response from codex:

LGTM

• yarn.lock contains only patched js-yaml 3.15.0/4.3.0 and @babel/core 7.29.7; vulnerable 3.14.2, 4.1.1, and 7.29.0 are absent.
• Only package.json and yarn.lock changed; the sole production dependency remains untouched.
• Babel’s dev-only transitive stack is consistently aligned at 7.29.7 and remains within existing semver ranges.
• The @microsoft/api-documenter deferral is justified: its ~4.1.0 pin lacks a patched version, while the scoped same-major override to 4.3.0 is limited to documentation tooling.

(codex ran locally via codex exec read-only; relayed here — GitHub blocked codex posting directly under the sandbox.)