deps: bump js-yaml from 5.2.2 to 5.2.3

[dependabot]

Bumps js-yaml from 5.2.2 to 5.2.3.

Changelog

Sourced from js-yaml's changelog.

[5.2.3] - 2026-08-01

Fixed

• Prevent prototype fallback when resolving tags and mapping entries, #782.
• Resolve !!timestamp years 0000-0099 correctly, #775.
• Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.
• Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

Commits

• 6740445 5.2.3 released
• 94e766d Update changelog
• c3bd7ca Polish previous commit, #780
• 00209b6 presenter: treat a tab-indented line in a folded scalar as more-indented (#780)
• 40fcb4f Fix missing mapping values before document markers and reject unpaired mappin...
• 49280f3 Fix !!timestamp resolution for years 0000-0099, #775
• 355dc96 fix: prevent prototype fallback in tag and harden object lookups, #782 (than...
• d524f83 docs: add contributing guidelines
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
care-sync	Error		Aug 10, 2026 11:22am

[github-actions]

🎉 Thank you for submitting a Pull Request to CareSync!

We appreciate your contribution.

Before review, please ensure:

✅ Your branch is up to date with the latest main branch
✅ Code follows project conventions
✅ Changes are focused and relevant
✅ Documentation is updated if necessary
✅ The application builds successfully

A maintainer will review your contribution soon.

Thank you for helping make CareSync better! 🚀

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/js-yaml	5.2.3	🟢 6.1	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 1 Found 3/30 approved changesets -- score normalized to 1 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Security-Policy 🟢 4 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• package-lock.json

[github-actions]

🤖 CI Pipeline Results

Check	Status
ESLint	❌ Failed
TypeScript	❌ Failed
Tests	❌ Failed

📋 ESLint Output

> caresync-web@0.1.0 lint
> eslint "src/**/*.{js,jsx,ts,tsx}" "server/**/*.{js,jsx}"


Oops! Something went wrong! :(

ESLint: 10.6.0

ESLint couldn't find an eslint.config.(js|mjs|cjs) file.

From ESLint v9.0.0, the default configuration file is now eslint.config.js.
If you are using a .eslintrc.* file, please follow the migration guide
to update your configuration file to the new format:

https://eslint.org/docs/latest/use/configure/migration-guide

If you still have problems after following the migration guide, please stop by
https://eslint.org/chat/help to chat with the team.

🔷 TypeScript Output

Version 6.0.3
tsc: The TypeScript Compiler - Version 6.0.3

COMMON COMMANDS

  tsc
  Compiles the current project (tsconfig.json in the working directory.)

  tsc app.ts util.ts
  Ignoring tsconfig.json, compiles the specified files with default compiler options.

  tsc -b
  Build a composite project in the working directory.

  tsc --init
  Creates a tsconfig.json with the recommended settings in the working directory.

  tsc -p ./path/to/tsconfig.json
  Compiles the TypeScript project located at the specified path.

  tsc --help --all
  An expanded version of this information, showing all possible compiler options

  tsc --noEmit
  tsc --target esnext
  Compiles the current project, with additional settings.

COMMAND LINE FLAGS

--help, -h
Print this message.

--watch, -w
Watch input files.

--all
Show all compiler options.

--version, -v
Print the compiler's version.

--init
Initializes a TypeScript project and creates a tsconfig.json file.

--project, -p
Compile the project given the path to its configuration file, or to a folder with a 'tsconfig.json'.

--showConfig
Print the final configuration instead of building.

--ignoreConfig
Ignore the tsconfig found and build with commandline options and files.

--build, -b
Build one or more projects and their dependencies, if out of date

COMMON COMPILER OPTIONS

--pretty
Enable color and formatting in TypeScript's output to make compiler errors easier to read.
type: boolean
default: true

--declaration, -d
Generate .d.ts files 

🧪 Test Output

> caresync-web@0.1.0 test
> react-app-rewired test --coverage --ci

PASS src/utils/notifications.test.js
  ● Console

    console.warn
      This browser does not support notifications.

    �[0m �[90m 50 |�[39m �[36mexport�[39m �[36masync�[39m �[36mfunction�[39m requestNotificationPermission() {
     �[90m 51 |�[39m   �[36mif�[39m (�[36mtypeof�[39m window �[33m===�[39m �[32m'undefined'�[39m �[33m||�[39m �[33m!�[39m(�[32m'Notification'�[39m �[36min�[39m window)) {
    �[31m�[1m>�[22m�[39m�[90m 52 |�[39m     console�[33m.�[39mwarn(�[32m'This browser does not support notifications.'�[39m)�[33m;�[39m
     �[90m    |�[39m             �[31m�[1m^�[22m�[39m
     �[90m 53 |�[39m     �[36mreturn�[39m �[32m'denied'�[39m�[33m;�[39m
     �[90m 54 |�[39m   }
     �[90m 55 |�[39m�[0m

      at requestNotificationPermission (src/utils/notifications.js:52:13)
      at Object.<anonymous> (src/utils/notifications.test.js:57:55)

PASS src/utils/settingsPreferences.test.js
PASS src/utils/proxyConfig.test.js
PASS src/utils/sanitize.test.js
  ● Console

    console.warn
      Prototype pollution attempt blocked. Rejected key: "__proto__"

    �[0m �[90m 44 |�[39m   �[36mfor�[39m (�[36mconst�[39m key �[36mof�[39m �[33mObject�[39m�[33m.�[39mkeys(obj)) {
     �[90m 45 |�[39m     �[36mif�[39m (�[33mDANGEROUS_KEYS�[39m�[33m.�[39mhas(key�[33m.�[39mtrim()�[33m.�[39mtoLowerCase())) {
    �[31m�[1m>�[22m�[39m�[90m 46 |�[39m       console�[33m.�[39mwarn(�[32m`Prototype pollution attempt blocked. Rejected ke

Automated feedback by CareSync CI — fix any issues above before requesting review.