From ae897c4185e1c2c7015bc96820429ddd276f2b3d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 21 Aug 2026 21:48:10 +0000
Subject: [PATCH] Update js-yaml from ~4.1.0 to ~4.2.0 to address
 GHSA-h67p-54hq-rp68

Co-authored-by: dmichon-msft <26827560+dmichon-msft@users.noreply.github.com>
---
 apps/api-documenter/package.json                       |  2 +-
 apps/lockfile-explorer/package.json                    |  2 +-
 .../rush/update-js-yaml-security_2026-06-24-18-22.json | 10 ++++++++++
 libraries/rush-lib/package.json                        |  2 +-
 repo-scripts/doc-plugin-rush-stack/package.json        |  2 +-
 5 files changed, 14 insertions(+), 4 deletions(-)
 create mode 100644 common/changes/@microsoft/rush/update-js-yaml-security_2026-06-24-18-22.json

diff --git a/apps/api-documenter/package.json b/apps/api-documenter/package.json
index 79c24b7de12..710721401d6 100644
--- a/apps/api-documenter/package.json
+++ b/apps/api-documenter/package.json
@@ -52,7 +52,7 @@
     "@rushstack/node-core-library": "workspace:*",
     "@rushstack/terminal": "workspace:*",
     "@rushstack/ts-command-line": "workspace:*",
-    "js-yaml": "~4.1.0",
+    "js-yaml": "~4.2.0",
     "resolve": "~1.22.1"
   },
   "devDependencies": {
diff --git a/apps/lockfile-explorer/package.json b/apps/lockfile-explorer/package.json
index 9bc1f73fd31..1630517f467 100644
--- a/apps/lockfile-explorer/package.json
+++ b/apps/lockfile-explorer/package.json
@@ -71,7 +71,7 @@
     "@rushstack/ts-command-line": "workspace:*",
     "cors": "~2.8.5",
     "express": "4.21.1",
-    "js-yaml": "~4.1.0",
+    "js-yaml": "~4.2.0",
     "semver": "~7.7.4"
   },
   "exports": {
diff --git a/common/changes/@microsoft/rush/update-js-yaml-security_2026-06-24-18-22.json b/common/changes/@microsoft/rush/update-js-yaml-security_2026-06-24-18-22.json
new file mode 100644
index 00000000000..fc101d14f73
--- /dev/null
+++ b/common/changes/@microsoft/rush/update-js-yaml-security_2026-06-24-18-22.json
@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "comment": "Update js-yaml dependency to ~4.2.0 to address security advisory GHSA-h67p-54hq-rp68 (poor performance characteristics with certain input)",
+      "type": "none",
+      "packageName": "@microsoft/rush"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}
diff --git a/libraries/rush-lib/package.json b/libraries/rush-lib/package.json
index c1e072cd268..a46a62d8d7d 100644
--- a/libraries/rush-lib/package.json
+++ b/libraries/rush-lib/package.json
@@ -68,7 +68,7 @@
     "@inquirer/input": "~5.0.11",
     "@inquirer/search": "~4.1.7",
     "@inquirer/select": "~5.1.3",
-    "js-yaml": "~4.1.0",
+    "js-yaml": "~4.2.0",
     "npm-package-arg": "~6.1.0",
     "object-hash": "3.0.0",
     "pnpm-sync-lib": "0.3.4",
diff --git a/repo-scripts/doc-plugin-rush-stack/package.json b/repo-scripts/doc-plugin-rush-stack/package.json
index f398bfe0ed7..e0eb62877ff 100644
--- a/repo-scripts/doc-plugin-rush-stack/package.json
+++ b/repo-scripts/doc-plugin-rush-stack/package.json
@@ -36,7 +36,7 @@
     "@microsoft/api-extractor-model": "workspace:*",
     "@microsoft/tsdoc": "~0.16.0",
     "@rushstack/node-core-library": "workspace:*",
-    "js-yaml": "~4.1.0"
+    "js-yaml": "~4.2.0"
   },
   "devDependencies": {
     "@rushstack/heft": "workspace:*",