Update dependency js-yaml to v4.1.1 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
js-yaml	4.1.0 -> 4.1.1

GitHub Vulnerability Alerts

CVE-2025-64718

Impact

In js-yaml 4.1.0, 4.0.0, and 3.14.1 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted.

Patches

Problem is patched in js-yaml 4.1.1 and 3.14.2.

Workarounds

You can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).

References

https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html

---

Release Notes

nodeca/js-yaml (js-yaml)

v4.1.1

Compare Source

Security

• Fix prototype pollution issue in yaml merge (<<) operator.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm WARN config optional Use `--omit=optional` to exclude optional dependencies, or
npm WARN config `--include=optional` to include them.
npm WARN config 
npm WARN config     Default value does install optional deps unless otherwise omitted.
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: ajv-keywords@3.5.2
npm WARN Found: ajv@8.6.3
npm WARN node_modules/ajv
npm WARN   dev ajv@"8.6.3" from the root project
npm WARN   1 more (table)
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer ajv@"^6.9.1" from ajv-keywords@3.5.2
npm WARN node_modules/ajv-keywords
npm WARN   ajv-keywords@"^3.5.2" from schema-utils@3.0.0
npm WARN   node_modules/copy-webpack-plugin/node_modules/schema-utils
npm WARN   3 more (schema-utils, schema-utils, schema-utils)
npm WARN 
npm WARN Conflicting peer dependency: ajv@6.12.6
npm WARN node_modules/ajv
npm WARN   peer ajv@"^6.9.1" from ajv-keywords@3.5.2
npm WARN   node_modules/ajv-keywords
npm WARN     ajv-keywords@"^3.5.2" from schema-utils@3.0.0
npm WARN     node_modules/copy-webpack-plugin/node_modules/schema-utils
npm WARN     3 more (schema-utils, schema-utils, schema-utils)
npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR! 
npm ERR! While resolving: jest-puppeteer@5.0.4
npm ERR! Found: puppeteer@13.1.2
npm ERR! node_modules/puppeteer
npm ERR!   dev puppeteer@"13.1.2" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer puppeteer@">= 1.5.0 < 10" from jest-puppeteer@5.0.4
npm ERR! node_modules/jest-puppeteer
npm ERR!   dev jest-puppeteer@"5.0.4" from the root project
npm ERR! 
npm ERR! Conflicting peer dependency: puppeteer@9.1.1
npm ERR! node_modules/puppeteer
npm ERR!   peer puppeteer@">= 1.5.0 < 10" from jest-puppeteer@5.0.4
npm ERR!   node_modules/jest-puppeteer
npm ERR!     dev jest-puppeteer@"5.0.4" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /runner/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /runner/cache/others/npm/_logs/2025-12-03T20_05_40_468Z-debug-0.log