deps: bump js-yaml to 4.3.2 to close a new HIGH alert

[GeiserX]

A new HIGH alert (#177, GHSA-2883-xcg3-v3hh, CVSS 7.5) landed on main minutes after #140 merged: maxTotalMergeKeys does not limit CPU use for empty merge sources. It is the follow-up to the js-yaml advisory fixed last month, which took us to 4.3.1. The fix is 4.3.2.

Change

Lockfile only, 3 lines. js-yaml is a transitive dev dependency and its only dependent declares js-yaml: ^4.3.0, so 4.3.2 satisfies it with no overrides entry. There is a single hoisted copy in the tree, now at 4.3.2.

Verification

• vitest run: 1078 passed (49 files)
• tsc --noEmit: clean
• Every js-yaml copy in the lockfile is at 4.3.2

npm run lint still fails the same way it does on main (TypeError: Converting circular structure to JSON inside ESLint's own config loader). Pre-existing and unrelated, same as on #140.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: f2c20b1d-5f97-416f-bf5a-b8f31017739e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}