MLE-31390: [HIGH] BDSA-2026-21635 in js-yaml v4.2.0 (MarkLogic-DevExp-nodeapi)

[ngodugu-marklogic]

Title:

MLE-31390: remediate BDSA-2026-21635 by pinning js-yaml to 4.3.0

Description:

This PR remediates the high-severity vulnerability BDSA-2026-21635 in js-yaml (DoS via algorithmic complexity) for the develop branch of MarkLogic-DevExp-nodeapi.

What changed:

Added an override to force js-yaml 4.3.0 in package.json.
Regenerated the lockfile so js-yaml resolves to 4.3.0 in package-lock.json.

Why this approach:

4.3.0 is the recommended patched version for this advisory.
Current transitive dependents resolve js-yaml on the 4.x line, so pinning to 4.3.0 is the lowest-risk fix.
Avoids a major jump to 5.x in this security patch PR.

Validation performed:

Confirmed the js-yaml entry resolves to 4.3.0 in package-lock.json
Confirmed no js-yaml 4.2.0 lockfile entry remains.
Ran lockfile audit; js-yaml vulnerability is no longer present in reported findings.

[Copilot]

Pull request overview

This PR addresses the vulnerability report for js-yaml by forcing the dependency graph to use a newer js-yaml release across the repo’s tooling dependencies.

Changes:

• Pinned js-yaml to 4.3.0 via package.json overrides.
• Updated package-lock.json to reflect js-yaml resolving to 4.3.0.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Adds an override to force js-yaml to 4.3.0.
package-lock.json	Updates the locked js-yaml package entry from 4.2.0 to 4.3.0.