[Deps] chore(deps): safe patch update - js-yaml 5.4.2 (2026-09-19) #8768

Automated Safe Dependency Update

This PR contains a safe patch-level dependency update identified by the Dependency Security Monitor workflow.

Vulnerability Assessment

• npm audit (run against the public npm registry): 0 vulnerabilities found across 924 dependencies (prod 31, dev 894, optional 68).
• Dependabot alerts: No open alerts of any severity for this repository at time of run.
• Existing security issues: Searched for open issues labeled security/dependencies — none found.
• Existing dependency-update PRs: Searched for open PRs — none found, so this PR was created fresh.

Updated Dependencies

Security Fixes Included

None — this update was not driven by a specific CVE. It is a routine safe patch-level bump identified via npm outdated (checked against the public npm registry, since the repository's configured registry endpoint is not reachable through the firewall in this environment).

Notes

• Other outdated packages (@babel/core, @babel/preset-env, @types/node, @typescript-eslint/*, eslint, chalk, commander, execa, typescript, jest, babel-jest) were reviewed but not updated in this PR because they involve minor/major version jumps, not safe patch-level bumps, and are out of scope for this conservative automated update.
• package-lock.json was regenerated via npm install to reflect the bump.

Verification

• npm run build succeeds (TypeScript compiles cleanly)
• Full unit test suite run: 5954/5988 tests pass. The same 34 failures occur identically on main without this change (all in src/enclave/*.test.ts, caused by the sandbox lacking a writable /var/tmp directory) — confirmed pre-existing and unrelated to this update.
• No breaking changes expected for a patch-level semver bump

Generated by Dependency Security Monitor Workflow

• package.json

To route changes like this to a review issue instead of blocking, configure protected-files: fallback-to-issue in your workflow configuration.

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"

Generated by Dependency Security Monitor · copilot · auto · 58.5 AIC · ⊞ 11K · ◷