fix(deps): bump js-yaml to 4.3.2 to close CVE-2026-59870

[PierreBrisorgueil]

What

Bumps js-yaml from 4.2.0 to 4.3.2. Lockfile + manifest only, no source change.

Why

Two high-severity Dependabot alerts are open against the runtime scope:

Advisory	Vulnerable range	Fixed in
Quadratic CPU consumption in !!omap resolution (CVE-2026-59870)	>= 4.0.0, < 4.3.1	4.3.1
YAML merge-key chains force quadratic CPU consumption	>= 4.0.0, < 4.3.0	4.3.0

Runtime scope is correct: lib/services/express.js parses the OpenAPI spec with js-yaml at boot.

Why 4.3.2 and not 5.x

Dependabot proposed #3909 (4.2.0 -> 5.1.0) for the same alerts, but that PR is red and cannot ship as-is:

• v5 removes the ESM default export. lib/services/express.js:17 and modules/tasks/tests/tasks.openapi-operationid.unit.tests.js:2 both use import YAML from 'js-yaml', so v5 breaks application boot, not only tests (lib/app.js imports express.js).
• v5 also switches load() from DEFAULT_SCHEMA to CORE_SCHEMA (no !!merge by default) and makes load('') throw — a behaviour change on the exact code path that serves the OpenAPI docs.

4.3.2 is inside the existing ^4.2.0 range, closes both advisories, and needs no migration. The v5 move stays a separate, deliberate decision.

Refs #3909

Summary by CodeRabbit

• Chores
  • Updated the YAML parsing dependency to a newer version for improved maintenance and compatibility.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: cb2a67bf-166e-4674-94a3-5a70d8cd4d9e

📥 Commits

Reviewing files that changed from the base of the PR and between 1a68f11 and 182a30a.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The pull request updates the js-yaml dependency constraint in package.json from ^4.2.0 to ^4.3.2.

Changes

Dependency update

Layer / File(s)	Summary
Update js-yaml constraint package.json	The js-yaml dependency constraint changes from ^4.2.0 to ^4.3.2.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 182a3

This localized dependency update moves js-yaml to 4.3.2 to address the reported vulnerabilities while remaining within the existing v4 range; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains what changed, why the 4.3.2 version was selected, the affected runtime path, the advisories, and the related Dependabot pull request. It does not follow the repository templat…	Restructure the description using the repository template. Add the impacted module, cross-module impact, risk level, validation results for lint and tests, manual-check status, guardrail confirmations, security and mergeability notes, and a…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the dependency update and its security purpose. It is concise and directly related to the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains what changed, why the 4.3.2 version was selected, the affected runtime path, the advisories, and the related Dependabot pull request. It does not follow the repository template and omits explicit scope, risk level, validation results, guardrail confirmations, and reviewer notes.

Resolution

Restructure the description using the repository template. Add the impacted module, cross-module impact, risk level, validation results for lint and tests, manual-check status, guardrail confirmations, security and mergeability notes, and a rollback plan. Keep the existing advisory and js-yaml 4.x compatibility rationale.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/js-yaml-4.3.2-cve

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.06%. Comparing base (099114f) to head (182a30a).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4028   +/-   ##
=======================================
  Coverage   94.06%   94.06%           
=======================================
  Files         170      170           
  Lines        5833     5833           
  Branches     1867     1868    +1     
=======================================
  Hits         5487     5487           
  Misses        283      283           
  Partials       63       63           

Flag	Coverage Δ
integration	62.24% <ø> (ø)
unit	77.57% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c39e3ee...182a30a. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.