From 0fc99f737dd585001799e8ebe7c6f511e158a84a Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Thu, 17 Sep 2026 11:11:22 +0000
Subject: [PATCH] chore(security): patch 1 Dependabot alert

Bump js-yaml resolution from ^4.3.1 to ^4.3.2 to pick up the fix
for GHSA-2883-xcg3-v3hh (CVE-2026-84375): maxTotalMergeKeys does
not limit CPU use for empty merge sources.
---
 package.json | 2 +-
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index d40560f1c..4753c745b 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "fast-uri": "^3.1.6",
     "tar": "^7.5.21",
     "ip-address": "^10.3.1",
-    "js-yaml": "^4.3.1",
+    "js-yaml": "^4.3.2",
     "postcss-selector-parser": "^7.1.3",
     "pacote": "^21.5.1"
   }
diff --git a/yarn.lock b/yarn.lock
index 37197dd45..b37f8e0e6 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2009,10 +2009,10 @@ js-tokens@^4.0.0:
   resolved "https://registry.yarnpkg.com/js-tokens/-/js-tokens-4.0.0.tgz#19203fb59991df98e3a287050d4647cdeaf32499"
   integrity sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==
 
-js-yaml@^4.1.0, js-yaml@^4.3.1:
-  version "4.3.1"
-  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.1.tgz#01216c001d67f48e2cd560d708c7af21090a3848"
-  integrity sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==
+js-yaml@^4.1.0, js-yaml@^4.3.2:
+  version "4.3.2"
+  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.2.tgz#8e44fb14a2643c59726bb15787b5f1512cb3d3fb"
+  integrity sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==
   dependencies:
     argparse "^2.0.1"