From 4bfe0527ce21c43e905e1bdc33ae317b092d3da8 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Fri, 24 Jul 2026 14:03:02 -0500
Subject: [PATCH] Bump js-yaml to a patched version

Adds an npm override pinning the transitive js-yaml dependency to its
patched version:

- js-yaml 4.2.0 -> 4.3.0 (GHSA-52cp-r559-cp3m, CVE-2026-59869)

Stays within the current major version line.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 578b6525-9314-4451-8a03-97df3e5f04cd
---
 package-lock.json | 19 ++++++++++---------
 package.json      |  5 +++--
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index f6f01c37eb..67f2fc4bde 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -611,9 +611,9 @@
       "dev": true
     },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
       "dev": true,
       "funding": [
         {
@@ -625,6 +625,7 @@
           "url": "https://github.com/sponsors/nodeca"
         }
       ],
+      "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1"
       },
@@ -993,7 +994,7 @@
         "globals": "^13.9.0",
         "ignore": "^5.2.0",
         "import-fresh": "^3.2.1",
-        "js-yaml": "^4.1.0",
+        "js-yaml": "^4.3.0",
         "minimatch": "^3.0.4",
         "strip-json-comments": "^3.1.1"
       }
@@ -1184,7 +1185,7 @@
         "import-fresh": "^3.0.0",
         "imurmurhash": "^0.1.4",
         "is-glob": "^4.0.0",
-        "js-yaml": "^4.1.0",
+        "js-yaml": "^4.3.0",
         "json-stable-stringify-without-jsonify": "^1.0.1",
         "levn": "^0.4.1",
         "lodash.merge": "^4.6.2",
@@ -1435,9 +1436,9 @@
       "dev": true
     },
     "js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
       "dev": true,
       "requires": {
         "argparse": "^2.0.1"
@@ -1715,4 +1716,4 @@
       "dev": true
     }
   }
-}
+}
\ No newline at end of file
diff --git a/package.json b/package.json
index e6fbbbe9ab..3f232c697e 100644
--- a/package.json
+++ b/package.json
@@ -19,6 +19,7 @@
     "eslint-plugin-json": "^3.1.0"
   },
   "overrides": {
-    "lodash": ">=4.18.0"
+    "lodash": ">=4.18.0",
+    "js-yaml": "^4.3.0"
   }
-}
+}
\ No newline at end of file