CVE-2026-59869: patch js-yaml to v4.3.0

[celdrake]

CVE Fix

Vulnerabilities Addressed

CVE ID	Severity	Package	Old Version	New Version
CVE-2026-59869	High	js-yaml	4.1.0	4.3.0

Related: Dependabot alert #160 (GHSA-52cp-r559-cp3m).

https://github.com/advisories/

Strategy Justification

CVE-2026-59869 — js-yaml

Running npm update js-yaml was not enough as 2 dev tools were pinning to exact older versions.
Added overrides in package.json

• Upgraded js-yaml to 4.3.0 in libs/ui-components/, apps/standalone/, and apps/ocp-plugin/ to address CVE-2026-59869.
• Added root package.json overrides to enforce js-yaml@4.3.0 for development tools that pinned older versions.
• Affects shared UI component dependencies and both standalone and OCP plugin applications; no direct code or public API changes.
• No changes to libs/types/, libs/i18n/, libs/cypress/, proxy/, packaging/, or .github/workflows/. No Go auth proxy, container build, E2E test, or CI configuration changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 78bf61b9-1638-42f6-942c-9be2d79fc240

📥 Commits

Reviewing files that changed from the base of the PR and between bc73bce and f15f723.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (4)

• apps/ocp-plugin/package.json
• apps/standalone/package.json
• libs/ui-components/package.json
• package.json

---

Walkthrough

The pull request upgrades js-yaml to 4.3.0 in the OCP plugin, standalone app, and UI components manifests, and adds a root npm override for transitive resolution.

Changes

js-yaml dependency alignment

Layer / File(s)	Summary
Manifest dependency alignment apps/ocp-plugin/package.json, apps/standalone/package.json, libs/ui-components/package.json, package.json	The three package manifests request js-yaml ^4.3.0, while the root npm override pins resolution to 4.3.0.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested labels: ocp-plugin, standalone, ui-components

Suggested reviewers: rawagner

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the security fix and the js-yaml version upgrade reflected in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	No hardcoded secrets found in the changed manifests or lockfile; only normal npm integrity hashes and registry URLs appeared.
No-Weak-Crypto	✅ Passed	PR only updates js-yaml and lockfile deps; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons appear in the diff.
No-Injection-Vectors	✅ Passed	Only package manifests changed to pin js-yaml 4.3.0; no code changes introduced eval/exec/dangerouslySetInnerHTML/yaml.load risks.
Container-Privileges	✅ Passed	Only package.json/package-lock changed; no container/K8s manifests were modified, and no privileged/root/allowPrivilegeEscalation settings were introduced.
No-Sensitive-Data-In-Logs	✅ Passed	Diff only updates js-yaml versions/overrides in package metadata; no log statements or sensitive data were added.
Resource-Leaks	✅ Passed	PR only changes package.json/package-lock.json; no proxy/*.go files were touched, so the resource-leaks check is not applicable.
Unchecked-Errors	✅ Passed	PR only changes package manifests and lockfile; no Go files under proxy/ were touched, so no unchecked-error issues were introduced.
Ai-Attribution	✅ Passed	HEAD and PR commit use an acceptable 'Made-with: Cursor' trailer; no AI-related Co-Authored-By trailer found.
Generated-Files-Not-Hand-Edited	✅ Passed	Diff only touches package manifests and package-lock; no files under the generated paths were edited.
I18n-Compliance	✅ Passed	No .tsx files were changed in this PR; only package.json and package-lock.json changed, so there are no user-visible strings or t() calls to audit.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

_{Comment @coderabbitai help to get the list of available commands.}