Bump the js-yaml override past the !!omap advisory

[jeremy]

npm Audit (TypeScript SDK) fails on plain main, so this blocks every open PR and the next push.

GHSA-5p4m-2wfm-xmqj — quadratic CPU consumption in js-yaml's !!omap resolution (CVE-2026-59870, fix not backported to 3.x/4.x). Affects js-yaml 4.0.0 - 4.3.0, reaching us as openapi-typescript → @redocly/openapi-core → js-yaml.

$ npm audit --audit-level=high        # unmodified main
js-yaml  4.0.0 - 4.3.0
Severity: high
node_modules/@redocly/openapi-core/node_modules/js-yaml
1 high severity vulnerability          REAL_EXIT=1

The change

One line. There is already a js-yaml override in typescript/package.json, added for an earlier advisory — 4.3.0 has simply gone from being the safe floor to being the vulnerable ceiling.

-    "js-yaml": "^4.3.0"
+    "js-yaml": ">=4.3.1 <5"

Spelled >=4.3.1 <5 rather than ^4.3.1 to match the fast-uri sibling in the same block. A caret reads "compatible with 4.3.1"; what is meant is "at least 4.3.1, because everything below it is vulnerable". The floor is a security floor and the constraint should say so.

Nothing else in package.json moves, and there is no generator bump — this is the leaf tool-dep, not oapi-codegen.

Verification

• Red first: npm audit --audit-level=high on unmodified main → REAL_EXIT=1, the advisory above.
• Green: → REAL_EXIT=0. js-yaml resolves to 4.3.1 and dedupes to a single top-level entry; the nested @redocly/openapi-core/node_modules/js-yaml is gone.
• No generated drift. This was the real risk: js-yaml is what @redocly parses specs with, so a behavioural change there could move generated types. make ts-generate regenerates clean — the only diff is metadata.ts's generated timestamp, which is diffed and restored rather than blind-checked-out. src/generated/ is otherwise byte-identical.
• npm run typecheck and the full vitest suite pass.
• Full make clean.

Why it looked like main was fine

main's own npm Audit check is green only because that run predates the advisory's publication. Re-run it now and it fails. #684 was the clean proof it is environmental rather than any PR's doing: it contains zero JavaScript and still failed the audit.

Blocks: #681, #682, #684 — all three are UNSTABLE solely on this check.

---

Summary by cubic

Raise the js-yaml override to avoid the !!omap CPU DoS advisory and make npm audit pass again, unblocking all PRs.

• Dependencies
  • Set js-yaml override to >=4.3.1 <5 to address GHSA-5p4m-2wfm-xmqj (CVE-2026-59870).
  • Lockfile resolves to 4.3.1; the nested @redocly/openapi-core copy dedupes away.
  • Checks: npm audit exits 0; typecheck and tests pass; generated types unchanged.

^{Written for commit 8c71cf3. Summary will update on new commits.}

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.