chore(deps): override js-yaml (3.15.0 / 4.2.0) (DoS fixes)

[cliffhall]

Summary

Two js-yaml lines exist in the dependency tree, each affected by the quadratic-DoS advisories. This PR adds version-targeted npm overrides so each major stays on its own line and gets its respective patched release:

• js-yaml 3.x — pulled by @istanbuljs/load-nyc-config (used by jest coverage tooling), currently 3.14.2 → 3.15.0 (first 3.x release with the fix).
• js-yaml 4.x — pulled by @eslint/eslintrc, currently 4.1.1 → 4.2.0.

"overrides": {
  "get-intrinsic": "1.3.0",
  "js-yaml@<4": "3.15.0",
  "js-yaml@>=4": "4.2.0"
}

Why keep the majors separate

The js-yaml 3 → 4 API changed (e.g. safeLoad/safeDump were removed, default schema behavior differs). Forcing the 3.x consumer onto the 4.x line would break jest coverage tooling, so the two lines are pinned independently using version-targeted override keys rather than a single blanket override.

Verification

npm ls js-yaml --all after install:

├─┬ @eslint/eslintrc@3.3.3
│ └── js-yaml@4.2.0
└─┬ @istanbuljs/load-nyc-config@1.1.0
  └── js-yaml@3.15.0

No 3.x below 3.15.0, no 4.x below 4.2.0.

Checks run and passing: prettier --check ., npm run check-version, client eslint, client jest (535 tests, coverage exercises the 3.x line), CLI tests (85 tests), and npm run build. E2e (Playwright) skipped — requires browser downloads.

Resolves Dependabot alerts #134, #133
Part of #1706

🤖 Generated with Claude Code

https://claude.ai/code/session_01HiccCEh9mwCfVzE8qYcop1

[cliffhall]

@claude review — security dependency fix adding targeted js-yaml overrides (3.15.0 / 4.2.0, part of #1706). Verify it resolves the advisories, the majors stay separated, and nothing is broken. Flag anything actionable.

[claude]

Claude finished @cliffhall's task in 1m 34s —— View job

---

Review: js-yaml security overrides ✅

Verified against the GitHub Advisory Database, the resolved lockfile, and the npm registry. This is a clean, correct fix — approve.

• Read the diff (package.json + package-lock.json)
• Verify override syntax & that majors stay separated
• Confirm patched versions resolve the DoS advisories
• Verify install produces the expected tree
• Report findings

Advisories resolved

The target advisory is GHSA-h67p-54hq-rp68 (Quadratic-complexity DoS in merge-key handling). Confirmed patched ranges from the advisory DB:

Line	Vulnerable range	First patched	This PR pins	✓
3.x	< 3.15.0	3.15.0	js-yaml@<4 → 3.15.0	✅
4.x	>= 4.0.0, <= 4.1.1	4.2.0	js-yaml@>=4 → 4.2.0	✅

Both overrides land exactly on the first patched release. As a bonus, these versions also clear the older prototype-pollution advisory GHSA-mh29-5h37-fv8m (patched 3.14.2 / 4.1.1). npm audit no longer reports any js-yaml vulnerability.

Majors stay separated ✔

Version-targeted override keys are correct npm syntax, and the resolved tree confirms independence — only two js-yaml instances exist and each stays on its own major:

@eslint/eslintrc@3.3.3          → js-yaml@4.2.0   (satisfies its ^4.1.1)
@istanbuljs/load-nyc-config@1.1.0 → js-yaml@3.15.0 (satisfies its ^3.13.1, keeps safeLoad/safeDump API)

This is the right call — forcing the 3.x consumer onto 4.x would break the safeLoad/safeDump API that jest coverage tooling relies on.

Lockfile integrity ✔

The integrity hashes in package-lock.json for both js-yaml-3.15.0.tgz and js-yaml-4.2.0.tgz match the npm registry byte-for-byte. No tampering, npm ci will validate cleanly.

Minor note (non-blocking, forward-looking)

The js-yaml@>=4 key also matches the 5.x line (5.x now exists on npm). Today nothing in the tree wants 5.x, so there's no effect. But if a future transitive dependency ever requires ^5.0.0, this override would force it back down to 4.2.0 and could cause an ERESOLVE / break that consumer. Not worth changing now — just something to keep in mind when a js-yaml@5 consumer appears (at which point a third key like js-yaml@>=5 would be the fix). No action needed for this PR.

Verdict

Correct, minimal, and well-scoped. Resolves the DoS advisories, keeps the majors independent, and nothing is broken. 👍
• deps/security-js-yaml

[cliffhall]

Superseded by #1718, which regenerates the lockfile with version-targeted overrides so every transitive copy is patched (npm wouldn't apply these overrides to the existing lockfile minimally, leaving residual vulnerable copies). js-yaml (#1713) was already resolved on main. See #1718 for the verified ALL-CLEAN result. Part of #1706.