Bump js-yaml from 5.3.0 to 5.4.1 in the minor-and-patch group

[dependabot]

Bumps the minor-and-patch group with 1 update: js-yaml.

Updates js-yaml from 5.3.0 to 5.4.1

Changelog

Sourced from js-yaml's changelog.

[5.4.1] - 2026-08-26

Changed

• Hard-limit merge sequence size to 100.

Security

• Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

• Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

• [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
• [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
• Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

• Accept a byte order mark at the start of each document in a stream, #791.
• Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
• Preserve empty scalar items when converting block sequences to flow style.
• Do not apply the 1024-character simple-key limit to flow mapping keys.
• Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
• Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

Commits

• e5a3ba0 5.4.1 released
• e54dea3 Hard-limit merge sequence size to 100
• dfd3a29 Cleanup 6a8e05f, #797
• 6a8e05f fix: count empty merge sources against maxTotalMergeKeys (#797)
• 6b4ff5e 5.4.0 released
• 3b3625e Update changelog
• 4f25a74 Fix file name
• 3bd003b Expose new scalar styling API
• fbb3e9d Remove regex lookbehind for ES2015 compatibility
• d43c185 Fix flowSkipColonSpace by forcing quoteFlowKeys
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[psiinon]

Checkmarx One – Scan Summary & Details – 82844079-dfd8-41f0-9b9b-95af5413d5a8

---

New Issues (13)

High: 4 · Medium: 6 · Low: 3

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		Reflected_XSS	server.js: 79	details The method embeds untrusted data in generated output with send, at line 80 of /server.js. This untrusted data is embedded into the output withou... Attack Vector
2		Reflected_XSS	server.js: 92	details The method embeds untrusted data in generated output with write, at line 96 of /server.js. This untrusted data is embedded into the output witho... Attack Vector
3		Reflected_XSS	server.js: 31	details The method embeds untrusted data in generated output with render, at line 44 of /server.js. This untrusted data is embedded into the output with... Attack Vector
4		Reflected_XSS	server.js: 25	details The method embeds untrusted data in generated output with render, at line 25 of /server.js. This untrusted data is embedded into the output with... Attack Vector
5		Container Capabilities Unrestricted	docker-compose.yml: 2	details Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnec...
6		Container Traffic Not Bound To Host Interface	docker-compose.yml: 6	details Incoming container traffic should be bound to a specific host interface
7		Healthcheck Not Set	docker-compose.yml: 2	details Check containers periodically to see if they are running properly.
8		Missing_HSTS_Header	server.js: 19	details The web-application does not define an HSTS header, leaving it vulnerable to attack. Attack Vector
9		Open_Redirect	server.js: 72	details The potentially tainted value provided by url in /server.js at line 72 is used as a destination URL by redirect in /server.js at line 73, potenti... Attack Vector
10		Security Opt Not Set	docker-compose.yml: 2	details Attribute 'security_opt' should be defined.
11		Missing_CSP_Header	server.js: 19	details A Content Security Policy is not explicitly defined within the web-application. Attack Vector
12		Unpinned Actions Full Length Commit SHA	/ci.yml: 45	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help...
13		Unpinned Actions Full Length Commit SHA	/ci.yml: 48	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help...

---

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR