fix(deps): raise js-yaml past the advisory the previous pin held it below

[yordis]

• Two high severity js-yaml advisories have been open against docs/pnpm-lock.yaml since 13 September and Dependabot has not opened anything for them. That is not Dependabot being slow. docs/pnpm-workspace.yaml already carried "js-yaml@>=4.0.0 <4.3.1": 4.3.1, added for an earlier advisory, and the new one covers < 4.3.2. The override was pinning the package to a version that is now itself vulnerable, so there was no update Dependabot was permitted to make. A security control that silences its own alerting is worth noticing.

• The 3.x copy, reached through gray-matter, had no override at all and sat on 3.15.1 against an advisory covering < 3.15.2.

• Both ranges are now expressed against the patched versions rather than the previously patched ones. The resulting lockfile change is confined to js-yaml: nothing else moved.

• The same shape applies to the other pinned ranges in that file, postcss-selector-parser twice over. They are correct against today's advisories, but they will fail the same quiet way if a future advisory extends past the pin, because an override that is exactly equal to the fixed version leaves no room for the next one.

[cursor]

PR Summary

Low Risk
Dependency-only security pin updates in the docs workspace with no application code changes.

Overview
Updates docs pnpm overrides and pnpm-lock.yaml so js-yaml resolves to patched releases instead of versions that still match open advisories.

The v4 override moves from pinning 4.3.1 (now below the <4.3.2 advisory) to 4.3.2, and a new v3 override forces 3.15.2 for the gray-matter transitive on 3.15.1. Lockfile entries for both js-yaml majors and their dependents are bumped accordingly; no other packages change.

^{Reviewed by Cursor Bugbot for commit ddefc49. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: fd6be6c5-7692-40f2-a83a-fc1fe38735da

📥 Commits

Reviewing files that changed from the base of the PR and between e48a12f and ddefc49.

⛔ Files ignored due to path filters (1)

• docs/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• docs/pnpm-workspace.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The workspace configuration adds a js-yaml 3.x override and updates the js-yaml 4.x override.

Changes

js-yaml override updates

Layer / File(s)	Summary
Update js-yaml version overrides docs/pnpm-workspace.yaml	Adds a 3.x override to 3.15.2 and updates the 4.x override to 4.3.2 with the range >=4.0.0 <4.3.2.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to ddefc

The dependency update is limited to the intended js-yaml security patches and is ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the main change: raising the js-yaml dependency override beyond the vulnerable pinned version.
Description check	✅ Passed	The description directly explains the js-yaml advisories, the updated 3.x and 4.x overrides, and the limited lockfile changes.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch yordis/fix-docs-js-yaml-advisory

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the YAML lines
New js-yaml pins align
Three-point-fifteen and four-point-three
Sit neatly in the workspace tree
Configuration hops along fine}

_{Comment @coderabbitai help to get the list of available commands.}