build(deps-dev): bump js-yaml from 4.3.1 to 4.3.2

[alaingoga]

Summary

Upgrade the transitive development dependency js-yaml from 4.3.1 to 4.3.2 to remediate GHSA-2883-xcg3-v3hh, tracked by Dependabot alert 81.

Affected js-yaml 4.x versions (>=4.0.0 <4.3.2) do not count empty merge-source mappings toward maxTotalMergeKeys, allowing repeated merges to consume excessive CPU without reaching the configured limit. Version 4.3.2 counts each merge-source mapping against that budget.

Related: github/vuln-mgmt#250775 (due 2026-12-12 UTC). This issue is robot-managed and should remain open until the scanner detects resolution; this PR deliberately does not auto-close it.

The previous Dependabot upgrade, #46, moved js-yaml from 4.3.0 to 4.3.1. No open Dependabot PR covered 4.3.2 when this change was prepared.

Scope

Only package-lock.json changes: the node_modules/js-yaml version, resolved tarball URL, and integrity hash. Generated with:

npm update js-yaml --package-lock-only --ignore-scripts --no-audit --no-fund --registry=https://registry.npmjs.org/

@eslint/eslintrc@3.3.6 already requires js-yaml@^4.3.0, which accepts 4.3.2. No manifest change, override, parent upgrade, or unrelated lockfile churn is needed. The dependency remains development-only; no library source, API, runtime dependency, or UI change is included.

Validation

Validated locally with Node 26.5.0 and npm 11.17.0 (CI also uses Node 26):

Check	Result
npm ci --no-audit --no-fund	Passed
npm test	Passed: 11 tests across 2 files
npm run build	Passed, including prebuild ESLint and tsc --noEmit, plus ESM and CommonJS builds
npm ls js-yaml --all	Exactly one installed version: @eslint/eslintrc@3.3.6 > js-yaml@4.3.2
All js-yaml lock entries	Exactly one; version 4.3.2, marked development-only
Trusted registry verification	Resolved URL and integrity match registry.npmjs.org; downloaded tarball SHA-512 and SHA-1 match registry metadata
Dependency-age policy	4.3.2 was published 2026-08-26; satisfies .npmrc's min-release-age=3
Direct diff review and git diff --check	Passed; only js-yaml version/resolved/integrity changed

Check notes: npm reported install-script approval warnings for existing fsevents@2.3.3 and unrs-resolver@1.11.1. Their scripts were left unapproved; installation and every check still passed. No script-approval policy was changed. Local npm audit was disabled and no third-party dependency scanner was used.

There is no repository-local PR template or SERVICEOWNERS file/gate. No files are added, renamed, or deleted. Existing CODEOWNERS routes review to @github/web-systems-reviewers. No workflows or ownership settings are changed.

CI and review readiness

All five reported checks passed on commit 72c17e771a6e7ee081a882f477e1232757d968ff: build (Node CI), Analyze (actions), Analyze (javascript-typescript) and aggregate CodeQL (CodeQL run), and github-advanced-security (run). No workflow approval is pending.

GitHub reports no merge conflicts. The remaining merge gate is one approving human review, required by branch protection. Review requests are present for @manuelpuyol and @github/web-systems-reviewers.

Automated review limitation: Copilot's reviewer reported that it could not review any files in this lockfile-only PR. The direct diff and dependency metadata checks above were completed; this is not a substitute for the required human approval.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.