build(deps-dev): Bump js-yaml from 4.3.1 to 4.3.2 in /eslint-factory in the npm_and_yarn group across 1 directory by dependabot[bot] · Pull Request #59629 · github/gh-aw

dependabot · 2026-09-09T04:09:04Z

Bumps the npm_and_yarn group with 1 update in the /eslint-factory directory: js-yaml.

Updates js-yaml from 4.3.1 to 4.3.2

Changelog

4.3.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

Commits

79ca68d 4.3.2 released
d90b661 Backport merge limits from v5.4.1
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 55.9 AIC · ⌖ 8.64 AIC · ⊞ 9K · ◷
_{Comment /souschef to run again}

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 34.8 AIC · ⌖ 8.66 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

Automated branch refresh attempt from PR Sous Chef. Run: https://github.com/github/gh-aw/actions/runs/34341665126

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 9.05 AIC · ⌖ 8.84 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

Bumps the npm_and_yarn group with 1 update in the /eslint-factory directory: [js-yaml](https://github.com/nodeca/js-yaml). Updates `js-yaml` from 4.3.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-09T08:59:29Z

Great work! 🚀 This dependency update looks solid. The js-yaml patch includes important security hardening for merge sequence limits (CVE mitigation) and is a straightforward, low-risk update to the package-lock.json. Everything checks out — this is ready for review!

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by ✅ Contribution Check · copilot · auto · 46.2 AIC · ⌖ 5.78 AIC · ⊞ 9.3K · ◷

gh-aw-bot · 2026-09-09T09:05:19Z

pr-sous-chef

@copilot Please take the next forward-progress pass on PR #59629.

Re-check the current HEAD and confirm the dependency bump is merge-ready.
Refresh the branch with the latest base changes if GitHub allows it.
Run the pr-finisher skill and push the smallest necessary follow-up, or summarize any maintainer-facing blocker if no code change is needed.

Generated by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/34331794656

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 34.8 AIC · ⌖ 8.66 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

Copilot · 2026-09-09T09:13:16Z

pr-sous-chef
```...

Checked HEAD 8bd0be0 and no follow-up code change was needed. Base main was fetched and the branch already contains it. Reviews: no review threads. Local validation passed (npm ci, npm run build, npm test in eslint-factory; make test-impacted-js BASE_REF=origin/main; make test-unit BASE_REF=origin/main; BASE_REF=origin/main make agent-report-progress). CI has no failed checks in the current rollup; only this agent run was still in progress during inspection, so final CI still needs normal maintainer re-trigger/refresh before merge.

…nd_yarn-56e86fd9c9

gh-aw-bot · 2026-09-09T10:51:10Z

@copilot Please review this PR for forward progress. If there are unresolved review comments or failing checks, address them and then run the pr-finisher skill. If the branch is stale, refresh it from the base branch.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 9.05 AIC · ⌖ 8.84 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

…rn/eslint-factory/npm_and_yarn-56e86fd9c9 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-09-09T10:58:26Z

@copilot Please review this PR for forward progress. If there are unresolved review comments or failing checks, address them and then run the pr-finisher skill. If the branch is stale, refresh it from...

Refreshed the branch from latest main in merge commit c2dd35e342. The PR diff remains only the eslint-factory/package-lock.json js-yaml bump. No review threads or failed prior CI jobs were found. Local validation passed with BASE_REF=origin/main make agent-report-progress; secret scan and advisory check for js-yaml@4.3.2 were clean. Current CI on this agent-pushed head still needs the normal maintainer-triggered refresh before merge.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 9, 2026

This comment has been minimized.

Sign in to view

This was referenced Sep 9, 2026

[Contribution Check Report] Contribution Check — 2026-09-09 #59599

Open

[pr-sous-chef] PR Sous Chef run report #59553

Closed

[pr-review] Daily PR Code Quality Review — 34316107420 #59650

Open

Copilot started work on behalf of gh-aw-bot September 9, 2026 09:06 View session

Copilot finished work on behalf of gh-aw-bot September 9, 2026 09:13

Copilot AI requested a review from gh-aw-bot September 9, 2026 09:13

github-actions Bot mentioned this pull request Sep 9, 2026

[pr-sous-chef] PR Sous Chef run summary #59692

Open

Merge branch 'main' into dependabot/npm_and_yarn/eslint-factory/npm_a…

0bd636c

…nd_yarn-56e86fd9c9

Copilot started work on behalf of gh-aw-bot September 9, 2026 10:51 View session

Merge remote-tracking branch 'origin/main' into dependabot/npm_and_ya…

c2dd35e

…rn/eslint-factory/npm_and_yarn-56e86fd9c9 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot September 9, 2026 10:58

pelikhan merged commit 7b6fa9c into main Sep 9, 2026

pelikhan deleted the dependabot/npm_and_yarn/eslint-factory/npm_and_yarn-56e86fd9c9 branch September 9, 2026 11:03

Navigation Menu

Uh oh!

build(deps-dev): Bump js-yaml from 4.3.1 to 4.3.2 in /eslint-factory in the npm_and_yarn group across 1 directory - #59629

build(deps-dev): Bump js-yaml from 4.3.1 to 4.3.2 in /eslint-factory in the npm_and_yarn group across 1 directory#59629
pelikhan merged 3 commits into
mainfrom
dependabot/npm_and_yarn/eslint-factory/npm_and_yarn-56e86fd9c9

dependabot Bot commented on behalf of github Sep 9, 2026 •

edited by github-actions Bot

Loading

Uh oh!

This comment has been minimized.

github-actions Bot commented Sep 9, 2026

Uh oh!

gh-aw-bot commented Sep 9, 2026

Uh oh!

Copilot AI commented Sep 9, 2026

Uh oh!

gh-aw-bot commented Sep 9, 2026

Uh oh!

Copilot AI commented Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 9, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

4.3.2 - 2026-08-26

Changed

Security

Uh oh!

This comment has been minimized.

github-actions Bot commented Sep 9, 2026

Uh oh!

gh-aw-bot commented Sep 9, 2026

Uh oh!

Copilot AI commented Sep 9, 2026

Uh oh!

gh-aw-bot commented Sep 9, 2026

Uh oh!

Copilot AI commented Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dependabot Bot commented on behalf of github Sep 9, 2026 •

edited by github-actions Bot

Loading