Bump transitive js-yaml to 4.3.1+ to fix CVE-2026-59870

[Copilot]

The @eslint/eslintrc devDependency resolved js-yaml@4.3.0, which is vulnerable to CVE-2026-59870 (quadratic CPU consumption in !!omap resolution; DoS). Fixed in 4.3.1. The direct js-yaml devDependency was already ^5.2.2 and unaffected.

Changes

• package.json — added a scoped override so only the transitive dependency is bumped, leaving the direct ^5.2.2 devDependency untouched:

  "overrides": {
    "postcss": "8.5.23",
    "@eslint/eslintrc": {
      "js-yaml": "^4.3.1"
    }
  }

• package-lock.json — regenerated; @eslint/eslintrc's js-yaml now resolves to 4.3.1.

Notes

• A top-level js-yaml override was intentionally avoided as it would downgrade the direct 5.2.2 dependency.
• The pre-existing brace-expansion audit finding is unrelated and left out of scope.

[Copilot]

Pull request overview

Updates the vulnerable transitive js-yaml dependency while preserving the direct 5.x dependency.

Changes:

• Adds a scoped @eslint/eslintrc override requiring js-yaml 4.3.1+.
• Regenerates the lockfile with js-yaml 4.3.1.

Show a summary per file

File	Description
package.json	Adds the scoped security override.
package-lock.json	Locks the transitive dependency to 4.3.1.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Balanced