fix(deps): resolve js-yaml CVE-2026-84375

[asachs01]

Summary

Resolves the open HIGH js-yaml Dependabot advisory CVE-2026-84375 so Vanta's "High vulnerabilities" test clears.

js-yaml is only a transitive devDependency here, flagged on both lines:

• 4.x (alert feat: Regular Time entry support with name resolution helpers #153, >= 4.0.0, < 4.3.2) — pulled via cosmiconfig
• 3.x (alert fix: include error details in 500/5xx ServerError messages #154, >= 3.0.0, < 3.15.2) — pulled via @istanbuljs/load-nyc-config

Fix

Added scoped npm overrides so each consumer stays on its own patched line (a blanket top-level js-yaml override would force the istanbul v3 consumer onto 4.x and break it):

"cosmiconfig": { "js-yaml": "^4.3.2" },
"@istanbuljs/load-nyc-config": { "js-yaml": "^3.15.2" }

Lockfile now resolves js-yaml to 4.3.2 (root) and 3.15.2 (under @istanbuljs/load-nyc-config).

Verification

• npm audit → 0 vulnerabilities
• npm run build ✅ · npm run lint ✅ · npm run test:unit ✅ (1918 passed, 42 skipped)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Bug Fixes

  • Remediated a reported security vulnerability affecting YAML processing.
  • Updated dependency resolution to use secure versions across supported package paths.
  • Confirmed that security auditing reports zero vulnerabilities.

• Documentation

  • Added an unreleased changelog entry documenting the security remediation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 904ef60e-771e-4ffe-9026-edd9cb34b209

📥 Commits

Reviewing files that changed from the base of the PR and between d30f91a and f9aa0af.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (2)

• CHANGELOG.md
• package.json

Included review availability: Your plan provides up to 10 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The change adds scoped npm overrides for patched js-yaml versions used by two transitive dependency paths. The changelog records the CVE remediation and a zero-vulnerability npm audit result.

Changes

js-yaml security remediation

Layer / File(s)	Summary
Patched transitive js-yaml resolution package.json, CHANGELOG.md	package.json overrides js-yaml to ^4.3.2 for cosmiconfig and ^3.15.2 for @istanbuljs/load-nyc-config. CHANGELOG.md records the CVE-2026-84375 remediation and documented zero-vulnerability audit result.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to f9aa0

The scoped overrides and committed lockfile align with the CI installation path, with no merge-blocking issue identified.

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: resolving the js-yaml CVE-2026-84375 dependency vulnerability.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Changelog Entry	✅ Passed	The PR adds a changelog entry at CHANGELOG.md line 26 under the root ## [Unreleased] heading and its ### Security section. The entry documents the js-yaml CVE remediation and matches the dependenc…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/js-yaml-advisory

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/js-yaml-advisory

---

_{Comment @coderabbitai help to get the list of available commands.}