chore(deps)(deps): bump js-yaml from 4.1.1 to 5.2.1

[dependabot]

Bumps js-yaml from 4.1.1 to 5.2.1.

Changelog

Sourced from js-yaml's changelog.

[5.2.1] - 2026-07-02

Fixed

• Add Map support to !!omap (should work when realMapTag used)

Security

• Remove quadratic complexity from !!omap addItem. Regression from v5 (usually not critical, because YAML11_SCHEMA is not default anymore).

4.3.0, 3.15.0 - 2026-06-27

Security

• Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
• Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

• maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

• Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

• Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

• [breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

• Added named exports for schemas, tags, parser events and AST utilities.
• Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.
• Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.
• Added dump() transform option for changing the generated AST before rendering.
• Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and

... (truncated)

Commits

• ac16b42 5.2.1 released
• 4a864e5 Deps bump
• 39f3211 !!omap: add Map support and remove quadratic complexity
• ff17f1e Changelog update
• 8ed15f1 deps bump
• 1a562dc Fix changelog link
• c28ed5e 5.2.0 released
• 125cd5a Add maxAliases option
• 3105455 Replace maxMergeSeqLengthoption with maxTotalMergeKeys (more robust)
• 39d00d6 numbers: Drop boxed numbers support, simplify .identify() checks, clarify rou...
• Additional commits viewable in compare view

---

Note

Medium Risk
Major-version YAML parse/dump library used on semantic-model and publish paths; typings stay on v4 and v5 includes breaking schema/quoting behavior despite security improvements.

Overview
Bumps js-yaml from 4.1.1 to 5.2.1 in the repo root, apps/api, and packages/core, with matching pnpm-lock.yaml updates (direct deps move to 5.2.1; some transitive copies stay on 4.3.0).

There are no application code changes—only dependency versions. Call sites still use the default import with yaml.load / yaml.dump for semantic-model and migration YAML (e.g. packages/core publish/semantic-model services and apps/api migrate scripts). @types/js-yaml remains at ^4.0.9.

The upgrade is a major release (schema/quoting behavior and new loader limits such as maxTotalMergeKeys), so behavior of parsed or emitted dataset YAML could shift if inputs hit edge cases; the stated motivation in the upstream changelog includes security fixes around merge/alias handling.

^{Reviewed by Cursor Bugbot for commit fbd8fd2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[cursor]

No security findings for the changed files.

Reviewed changes:

• package.json:27, apps/api/package.json:31, and packages/core/package.json:24 update direct js-yaml dependencies from ^4.1.1 to ^5.2.0.
• pnpm-lock.yaml updates the corresponding lockfile entries from js-yaml@4.1.1 to js-yaml@5.2.0 with the same argparse@2.0.1 dependency shape.

Threat surfaces checked against this diff:

1. MCP endpoint auth: no MCP route or token/project-scoping code changed.
2. Query execution sandboxing: no execute_query, DuckDB, view-scoping, timeout, or result-limit code changed.
3. Admin auth / Better Auth: no session secret, CSRF, cookie, or auth route code changed.
4. API input validation: no Hono route handlers, Zod schemas, MongoDB query construction, or DuckDB SQL construction changed.
5. Environment secrets: no .env* files or secret-handling/logging code changed.
6. Dependency exposure: ran pnpm audit --prod. It does not report a js-yaml advisory for the bumped version. The audit still reports existing transitive advisories for packages such as xlsx, @xmldom/xmldom, ws, and form-data, but the affected lockfile entries are present in both the base and head and are not introduced by this PR.

  

_{Sent by Cursor Automation: archmax Security Review}

[github-actions]

Docker image ready

docker pull ghcr.io/archmaxai/archmax:pr-76

[dependabot]

Superseded by #85.