From ca2fc253f6dfd4be2940bb6a33becfbd7b7aa016 Mon Sep 17 00:00:00 2001
From: Ben <benbart02@gmail.com>
Date: Mon, 14 Sep 2026 11:20:14 -0400
Subject: [PATCH] chore(security): bump js-yaml override to ^4.3.2
 (GHSA-2883-xcg3-v3hh, alert #75)

js-yaml < 4.3.2 does not limit CPU use for empty merge sources, so
maxTotalMergeKeys does not bound the work done when parsing a crafted
document (uncontrolled resource consumption).

Transitive, dev scope. Sole parent is @eslint/eslintrc (requests ^4.1.1,
which already accepts 4.3.2), so the existing global override just moves
^4.3.1 -> ^4.3.2. Resolved 4.3.1 -> 4.3.2 (patch on the v4-legacy line;
the 5.x latest tag is a major and unnecessary here).

Closes #75
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e65bea3..15b34fa 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3441,9 +3441,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "dev": true,
       "funding": [
         {
diff --git a/package.json b/package.json
index 2e1bb75..4278e60 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
   "overrides": {
     "brace-expansion@^1": "^1.1.16",
     "brace-expansion@^2": "^2.1.2",
-    "js-yaml": "^4.3.1",
+    "js-yaml": "^4.3.2",
     "nanoid": "^3.3.18",
     "postcss": "$postcss",
     "sharp": "^0.35.0"