From 6348728664fa43d90b00b75453d16dbbac681ed7 Mon Sep 17 00:00:00 2001 From: Shuchang Zheng Date: Tue, 25 Aug 2026 16:44:13 -0700 Subject: [PATCH] security: bump js-yaml to 4.3.1 (GHSA-5p4m-2wfm-xmqj) Closes the one open Dependabot alert on this repo. js-yaml is a transitive dev-only dependency of @napi-rs/cli; 4.3.1 satisfies the existing range, so the change is lockfile-only. Co-Authored-By: Claude Opus 5 (1M context) --- node/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/node/package-lock.json b/node/package-lock.json index 56a675b..089f517 100644 --- a/node/package-lock.json +++ b/node/package-lock.json @@ -1715,9 +1715,9 @@ } }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "dev": true, "funding": [ {