Bump js-yaml from 4.3.1 to 4.3.2

[dependabot]

Bumps js-yaml from 4.3.1 to 4.3.2.

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

Commits

• 79ca68d 4.3.2 released
• d90b661 Backport merge limits from v5.4.1
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Patch-level dependency update with tighter YAML merge parsing limits; lockfile-only change with low behavioral risk for normal configs.

Overview
Updates the lockfile so js-yaml resolves to 4.3.2 instead of 4.3.1 (transitive npm dependency).

That release backports merge-handling limits: merge sequences are capped at 100 entries, and empty mappings in merge sequences count toward maxTotalMergeKeys to reduce excessive CPU use when parsing hostile YAML (#797). No application source changes—only package-lock.json.

^{Reviewed by Cursor Bugbot for commit 2ae1305. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the js-yaml 4.3.1→4.3.2 update against the malware checklist, starting with upstream diffs, lockfile integrity, and the scanner findings.The scanner only lists changelog and package.json; I'll inspect the 4.3.1–4.3.2 git range to confirm whether source or install scripts also changed.Verdict: benign

This is a patch-level security backport on the established nodeca/js-yaml v4 line (4.3.1 → 4.3.2), not a supply-chain implant.

What changed: two maintainer commits (puzrin): merge-key CPU limits in lib/loader.js plus tests, then a version/changelog bump. Behavior is the documented #797 fix: charge empty merge mappings toward maxTotalMergeKeys and cap merge sequence size at 100. No new runtime deps (argparse only), no preinstall/install/postinstall scripts, no workflow or lockfile graph expansion.

Integrity: npm js-yaml@4.3.2 integrity matches this repo’s package-lock.json; registry gitHead is tag 4.3.2 (79ca68d…). Publisher remains vitaly.

Scanner: status warn is a false positive. The only heuristic hit is an old CHANGELOG line about rewriting base64 in the binary type for license clarity, not new encoded payload. Unicode/IOC/confusable: none. Scanner changed_files listed only changelog/package.json; the real range also includes lib/loader.js and a test file, which matches GitHub compare and is the expected security patch.

Compatibility Analysis

I'll inspect local js-yaml usage and the upstream 4.3.1→4.3.2 diff so the compatibility recommendation is based on actual call sites and changed APIs.Recommendation: merge

js-yaml 4.3.1 → 4.3.2 is a patch-level security backport. Public load / dump APIs are unchanged. This repo does not call js-yaml itself; local YAML does not use merge keys (<<).

1) Where it is used

Not a direct dependency (package.json has no js-yaml). It is hoisted once in package-lock.json to 4.3.2, required as ^4.1.0 by:

Consumer	Role in this site
@docusaurus/utils	YAML helpers during Docusaurus build
@docusaurus/utils-validation	YAML config validation
@docusaurus/plugin-content-docs	Docs plugin YAML
@11ty/gray-matter (via @docusaurus/utils)	Markdown/MDX frontmatter
cosmiconfig	Optional YAML config files for Babel/webpack tooling

App code (src/, docusaurus.config.js, sidebars.js, babel.config.js) has no require('js-yaml') / yaml.load. Docs frontmatter is small scalar maps (id, title, slug, …). k8s/certificate.yaml is a cluster manifest, not parsed by this Node build. No <<: merge keys in repo YAML/MD.

2) Intersection with changed APIs

4.3.2 (d90b661 + release bump) only tightens YAML merge (<<) in lib/loader.js:

• Count each merge-source mapping toward maxTotalMergeKeys (default still 10000), including empty {} (CVE-2026-84375 / #797).
• Hard-reject merge sequences longer than 100 (abnormal merge sequence size). Not a new public option.

Exports, constructors, dump, and default schema are otherwise the same. Docusaurus/gray-matter/cosmiconfig still call load on small trusted files. Those call sites do not hit the changed merge path.

3) Risks / unknowns

• Build/runtime: Compatible. Same major, same argparse dep, no new APIs consumers must adopt.
• Behavioral break only if a document merges >100 mappings in one <<: sequence, or a huge empty-map merge chain. This tree has neither.
• Unknown: third-party Docusaurus plugins with huge << YAML (none present here).
• Untrusted YAML: not in this app’s threat model; the patch still reduces DoS if a future path loads untrusted YAML (v4 merge is on by default).

4) Action

Merge PR #568. No app or config changes needed. Existing npm run build / Pages deploy is sufficient verification.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 2
• Resolution strategy: tag_range
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved upstream range: 86e91b815b8794c3c73a179c1770871e37ec2df8..79ca68d90f333fbe6d9e42827527e62636200191
• Resolved refs: from=86e91b815b8794c3c73a179c1770871e37ec2df8 to=79ca68d90f333fbe6d9e42827527e62636200191
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 1

Top findings

• CHANGELOG.md:534 obfuscation_indicator :: - Rewritten base64 encode/decode in binary type, to keep code licence clear.