chore(security): bump js-yaml override to ^4.3.2 (GHSA-2883-xcg3-v3hh, alert #75)

[benfrank241]

Daily security sweep — 2026-09-14. npm / root package-lock.json (the repo's only ecosystem/lockfile). One PR per (ecosystem, lockfile path).

Alert closed

alert	advisory	severity	package	scope	vulnerable	fixed in
#75	GHSA-2883-xcg3-v3hh	high	js-yaml	dev	>= 4.0.0, < 4.3.2	4.3.2

js-yaml's maxTotalMergeKeys limit does not bound CPU use for empty merge sources, so a crafted document can drive uncontrolled resource consumption through the merge-key path despite the cap.

The fix

The repo already carried a global overrides entry "js-yaml": "^4.3.1" from an earlier sweep. This moves it to ^4.3.2 and re-locks — resolved 4.3.1 → 4.3.2.

• Transitive, not a direct dependency. The sole requester in the tree is @eslint/eslintrc, declaring ^4.1.1, which already accepts 4.3.2 — so a global override is correct here and no parent scoping is needed.
• Patch bump on the v4-legacy line. js-yaml's latest dist-tag is 5.4.2; that is a major, is not required to clear the advisory, and would be a "propose, don't auto-apply" change. Staying on ^4.3.2.
• Regenerated with npm install --package-lock-only (no --force, no --legacy-peer-deps). Diff is 4 insertions / 4 deletions across 2 files — the one overrides line plus js-yaml's version/resolved/integrity. No other package moved.
• npm audit after the change no longer reports js-yaml; the two advisories it still reports are postcss-selector-parser and @humanfs/node, already covered by the open PRs below.

Verification

This repo's only CI workflow is the GitLeaks secret scan (secret-scan.yml) — there is no build/test/lint gate in CI. Locally, package.json has dev/build/start/lint and no test script, and next build is already red on main from pre-existing @typescript-eslint/no-explicit-any errors in source (tracked in #17, unrelated to dependencies). So this was verified three ways against a pristine origin/main control worktree at the same commit (d6f92b2):

1. Differential. npm ci exit 0 both sides. npm run build exits 1 on both sides with identical normalized diagnostic sets — 12 signature lines each (6 file paths + 6 diagnostics), diff empty. No new failure introduced.
2. True green. Rebuilt both sides with a temporary, uncommitted next.config.ts carrying eslint: { ignoreDuringBuilds: true }, bypassing only the unrelated pre-existing lint gate. Both sides exit 0, and the emitted route table is byte-identical (18 lines). The temporary edit was reverted before committing and git status confirmed clean — it is not in this diff.
3. Package-specific artifact check. js-yaml is loaded by @eslint/eslintrc, which this repo instantiates directly (eslint.config.mjs uses FlatCompat). Identical ESLint diagnostics across the version change is the meaningful behavioural signal for this package — the analogue of byte-comparing emitted CSS for a PostCSS bump.

Not included

• #73 / GHSA-w9m9-85wc-3x92 (postcss-selector-parser) — already covered by open PR chore(security): bump postcss-selector-parser >=6.1.3 (GHSA-w9m9-85wc-3x92, alert #73) #18.
• #74 / GHSA-p498-v437-472g (@humanfs/node) — already covered by open PR chore(security): bump @humanfs/node to ^0.16.8 (GHSA-p498-v437-472g, alert #74) #19.

No alerts were dismissed. No backlog items — nothing failed that is attributable to this change.

Note for whoever merges

PRs #18, #19 and this one all touch the same overrides block and the same package-lock.json, and are deliberately not stacked — each is branched from main so each gets its own CI. Whichever merges after the first will need a rebase and a re-lock so all three fixes survive.

Not merging — opened for review.