chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Bumped js-yaml to 4.3.1 in playground-app to resolve a high-severity quadratic CPU consumption vulnerability (alert fix(deps): update module google.golang.org/grpc to v1.52.0 - autoclosed #275)
• Bumped github.com/moby/go-archive to v0.3.3 in test/integration/go.mod to resolve a high-severity path-traversal vulnerability in tar extraction (alert chore(deps): update docker/build-push-action action to v3 #280)

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#275	js-yaml	high	Bumped to 4.3.1 via package.json/package-lock.json
#280	github.com/moby/go-archive	high	Bumped to v0.3.3 via go get/go mod tidy

Unresolvable (no compatible patched version)

The following alerts affect github.com/docker/docker in test/integration/go.mod, pulled in transitively via testcontainers-go, docker/buildx, and docker/compose/v5. Upstream moved the fixed releases (v29.x+) to a new module path (github.com/moby/moby/v2), so go get github.com/docker/docker@v29.3.1 fails outright (the tagged commit's go.mod declares module github.com/moby/moby/v2, not github.com/docker/docker). There is no compatible tagged version under the old github.com/docker/docker import path, and none of the transitive dependents have migrated to the new module path yet. No safe non-breaking fix is currently available.

Alert	Package	Severity	Status
#152	github.com/docker/docker	high	No compatible module version available (patched release lives under a different module path, github.com/moby/moby/v2)
#151	github.com/docker/docker	medium	No patched version reported for the affected code path
#184	github.com/docker/docker	high	No patched version reported for the affected code path
#185	github.com/docker/docker	medium	No patched version reported for the affected code path
#186	github.com/docker/docker	high	No patched version reported for the affected code path

[netlify]

✅ Deploy Preview for polite-licorice-3db33c canceled.

Name	Link
🔨 Latest commit	d38df6b
🔍 Latest deploy log	https://app.netlify.com/projects/polite-licorice-3db33c/deploys/6a8c52936b0d6e0008ffc534

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 31c2999e-8469-416f-9ff1-6be7edb3f6ce

📥 Commits

Reviewing files that changed from the base of the PR and between fd5e02f and d38df6b.

⛔ Files ignored due to path filters (1)

• test/integration/go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• test/integration/go.mod

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates the playground application's js-yaml dependency and several indirect dependencies used by integration tests.

Changes

Dependency updates

Layer / File(s)	Summary
Update js-yaml constraint playground-app/package.json	The runtime dependency constraint changes from ^4.2.0 to ^4.3.1.
Update integration test dependencies test/integration/go.mod	Indirect versions for github.com/klauspost/compress and selected Moby modules are updated.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to d38df

This change updates dependency versions to address security alerts without introducing an actionable merge-blocking risk; it is merge-ready after normal checks and review.

Suggested reviewers: toddbaert

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the dependency updates, resolved security alerts, and unresolved Docker alerts.
Title check	✅ Passed	The title accurately summarizes the dependency updates made to resolve Dependabot security alerts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[toddbaert]

closed/opened to try to fix seemingly stuck checks...

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Updates vulnerable JavaScript and Go dependencies used by the playground and integration tests.

Changes:

• Upgrades js-yaml to 4.3.1.
• Upgrades go-archive to v0.3.3 and related transitive dependencies.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.

File	Description
playground-app/package.json	Updates the js-yaml requirement.
playground-app/package-lock.json	Locks js-yaml 4.3.1.
test/integration/go.mod	Updates vulnerable Go dependencies.
test/integration/go.sum	Refreshes checksums for updated modules.

Files not reviewed (1)

• playground-app/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.