fix(deps): bump js-yaml override to 4.3.1 (clears the last open Dependabot alert, GHSA-5p4m-2wfm-xmqj)

[logbie]

What

Bumps the js-yaml override in vscode-extension/package.json from 4.3.0 → 4.3.1 and regenerates the lockfile.

Why

Dependabot alert #69 (HIGH, GHSA-5p4m-2wfm-xmqj, quadratic CPU consumption in !!omap resolution) covers js-yaml 3.x and 4.x below 4.3.1. The repo already carries a js-yaml override — it was pinned at 4.3.0 to clear the previous advisory on 2026-07-31 — so the pin exists but is now one patch short of the current one.

This is the only open Dependabot alert on the repository. The long-standing structural rustls-webpki cluster (8 alerts) and the brace-expansion cluster (10) were both resolved on 2026-07-31 and 2026-07-26 respectively, so merging this takes the repo to zero open alerts.

Root cause of the pin still being needed

js-yaml is a dev-only transitive dependency reached two ways:

eslint@8.57.1 → @eslint/eslintrc@2.1.4 → js-yaml
@vscode/test-cli@0.0.10 → mocha@10.8.2 → js-yaml

Neither parent has released a version that moves off the affected range, which is why the override exists rather than a straight dependency bump. Both parents accept 4.3.1, so it dedupes to a single copy with no parent bumps required.

Verification

Run locally against a clean tree:

• npm install --package-lock-only regenerated the entry with the registry integrity hash for 4.3.1 (sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==).
• npm ci succeeds from scratch — 270 packages, exit 0, no peer or range conflicts.
• npm ls js-yaml resolves all three consumers to 4.3.1, deduped:

  ├─┬ @vscode/test-cli@0.0.10 → mocha@10.8.2 → js-yaml@4.3.1 deduped
  └─┬ eslint@8.57.1
    ├─┬ @eslint/eslintrc@2.1.4 → js-yaml@4.3.1 deduped
    └── js-yaml@4.3.1 overridden
  

Diff is 4 lines across 2 files — the override value and the lockfile's version/resolved/integrity triple. No shipped Rust code, no workflow, no TestPrograms/ behaviour is touched.

Testing policy

R0 under root testing.md — a dependency-pin change with no behavioral surface in shipped code. No red-first test is manufactured; the existing lint and test lanes are the check, per the pure-CI-mechanics carve-out.

⚠️ CI cannot verify this right now

GitHub Actions on this repo has been failing at startup since ~04:00 UTC today — CI, Nightly Build, Auto Format and WFL Config Lint all return startup_failure with zero jobs created, because the Actions allowlist was narrowed and now blocks dtolnay/rust-toolchain and Swatinem/rust-cache. Full diagnosis in #695.

So this PR will show no CI signal until #695 is resolved. Please re-run checks on this branch after fixing the allowlist, before merging. The change is verified locally as described above, but "green because nothing ran" is not green.

Refs #695

Opened by the WFL repo warden (automated triage pass). Not merged — merging is a human decision.

---

Summary by CodeRabbit

• Chores
  • Updated the YAML parsing dependency to version 4.3.1 for improved maintenance and compatibility.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f229058b-984f-4db1-b8fa-ce4b60b19533

📥 Commits

Reviewing files that changed from the base of the PR and between 97a18ba and d07526f.

⛔ Files ignored due to path filters (1)

• vscode-extension/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• vscode-extension/package.json

---

📝 Walkthrough

Walkthrough

The VS Code extension updates the js-yaml dependency override from version 4.3.0 to 4.3.1.

Changes

Dependency override

Layer / File(s)	Summary
Update js-yaml override vscode-extension/package.json	The js-yaml override changes from 4.3.0 to 4.3.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to d0752

This localized dependency update has no actionable merge-blocking risk at the current head; it is merge-ready after normal checks and review.

Suggested reviewers: invalid-email-address

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the dependency override update and its security purpose.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch warden/bump-js-yaml-4.3.1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Lockfile root entry carries no overrides metadata, so the pin may not be reproducible via npm ci

The lockfile change (vscode-extension/package-lock.json:1909-1912) only edits the node_modules/js-yaml version/resolved/integrity triple, matching the previous 4.3.0 pin commit. However, the lockfile's root package entry (packages[""]) contains no overrides object, even though vscode-extension/package.json:176-179 declares overrides for js-yaml and serialize-javascript. npm normally records the resolved overrides block in the lockfile root when regenerating, and uses it to detect drift between package.json and the lock. Its absence suggests the lock was hand-edited rather than produced by npm install --package-lock-only, which could make npm ci reject or silently re-resolve the tree. Worth verifying by actually running npm install --package-lock-only && npm ci once CI is unblocked (per the PR description, CI currently cannot run).

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[Copilot]

Pull request overview

This PR clears Dependabot alert GHSA-5p4m-2wfm-xmqj by bumping the existing js-yaml npm override in the VS Code extension from 4.3.0 → 4.3.1, and updating the lockfile to match. The change is scoped to the vscode-extension/ dev dependency graph (not shipped Rust/WFL runtime code).

Changes:

• Update vscode-extension/package.json to pin js-yaml override to 4.3.1.
• Regenerate vscode-extension/package-lock.json so the node_modules/js-yaml entry reflects 4.3.1 (version/resolved/integrity).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
vscode-extension/package.json	Bumps the js-yaml override to 4.3.1 to address the advisory.
vscode-extension/package-lock.json	Updates the locked js-yaml package metadata to 4.3.1 (resolved URL + integrity).

Files not reviewed (1)

• vscode-extension/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.