chore(deps): bump js-yaml from 4.2.0 to 4.3.1

[dependabot]

Bumps js-yaml from 4.2.0 to 4.3.1.

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

• [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

• Restore umd builds back to es5.

Removed

• [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Commits

• 86e91b8 4.3.1 released
• c3cc4b0 Backport quadratic complexity fix for !!omap
• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• 6842ef6 doc polish
• See full diff in compare view

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[changeset-bot]

⚠️ No Changeset found

Latest commit: d493a7d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

Risk: low. Approved: Cursor Bugbot was not present on this PR, and the change is a narrow Dependabot patch bump of js-yaml (4.2.0→4.3.0) in package-lock.json only. No reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[yakimoto]

This becomes redundant if #65 lands (which contains #50) — worth holding rather than merging in parallel.

js-yaml@4.2.0 is reached only through @eslint/eslintrc. #50's eslint upgrade drops @eslint/eslintrc from the tree entirely, so js-yaml goes away rather than getting bumped. Measured, dev scope included:

	total	high	remaining
main @ eb79119	3	2	brace-expansion, esbuild, js-yaml
#65 (= #50 + brace-expansion 5.0.8)	1	0	esbuild

No js-yaml in the result — not at 4.3.0, not at all.

Merging this first isn't harmful, just wasted: it would bump a package that the eslint upgrade then removes, and both PRs rewrite package-lock.json, so they'd conflict. If for some reason #65/#50 stall, this PR is a correct standalone fix for alert #5 and should be merged on its own. Otherwise close it once #65 is in.

If both do end up landing, whichever goes second must re-run its own update command rather than hand-merging the lockfile — a hand-merged lockfile installs a tree that matches neither intent.

CI can't confirm any of this — Actions are refusing every job org-wide on an account-level billing lock (plan=free, locked=yes). Figures above are local, with NODE_ENV=development set explicitly because this workstation's NODE_ENV=production makes npm audit hide dev-scope entries, which is all of these.

[greptile-apps]

PR author is in the excluded authors list.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.