build(deps-dev): bump js-yaml from 4.3.0 to 4.3.1

[dependabot]

Bumps js-yaml from 4.3.0 to 4.3.1.

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

Commits

• 86e91b8 4.3.1 released
• c3cc4b0 Backport quadratic complexity fix for !!omap
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Ready	Preview, v0	Aug 7, 2026 8:47pm

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA d6c91a4.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
npm/js-yaml	4.3.1	🟢 6.1	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 1 Found 3/30 approved changesets -- score normalized to 1 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Security-Policy 🟢 4 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• package-lock.json

[groupthinking]

HALTED(ci_failing) — blocked by a gate Dependabot cannot satisfy; fix already written in #1423

Every check on head dff2ba6 passes except two, and both fail for the same structural reason rather than anything wrong with this diff.

The two red checks are one script. .github/workflows/pr-governance.yml has a single job (policy, named Canonical issue and evidence) which also publishes a second check run named PR Governance via checks.create. So one failure surfaces twice. Its output on this head:

## Canonical issue is missing or still contains only template placeholders;
## Outcome …; ## Risk …; ## Verification …; ## Production evidence …;
exactly one closing reference is required: Closes #<issue>

Dependabot composes its body from a fixed template (release notes, changelog, commit list). It cannot emit those five headings or a Closes #<issue> reference. This is not a bar this PR fails — it is one it has no way to clear, and no rebase, re-run, or ·@·d·ependabot r·ecreate changes that.

This is the failure mode MERGE_POLICY.md names in its own words:

A gate that cannot be satisfied is not strict — it is broken, and it teaches everyone to merge around it.

The fix exists and is complete: #1423. It adds an author-keyed exemption that publishes neutral (not success — the contract is not applicable, which is a different claim from satisfied) and returns before the body parsing, so both the published check and the job itself go green. It ships five behavioural tests that execute the real gate script under Node, including two negative cases confirming the exemption is keyed on author rather than body shape, so it cannot be satisfied by simply dropping the section requirement.

I traced #1423's patch against this head and it clears both red checks here. #1423 is currently a draft.

Everything else is green

validate, guards, lint-python, lint-frontend, build, test, CodeQL, gitleaks (working tree), dependency-review, bandit, trivy, npm-audit, python-safety, both Security Scans, label, Vercel. E2E Pipeline Tests skipped. Trivy (capitalised) is neutral — the never-passing duplicate documented in #1410. mergeable_state is clean; no conflicts.

The change itself is js-yaml 4.3.0 → 4.3.1, a dev-dependency patch confined to package-lock.json — Class A under MERGE_POLICY.md gate 8, and dependency-review reports no vulnerability, license, or Scorecard issues.

Disposition

Recorded as HALTED(ci_failing), blocker not fixable on this branch. Two human calls, neither of which an agent should make unilaterally:

1. Land fix(ci): stop the canonical-evidence gate failing Dependabot by construction #1423 (mark ready → review → merge), after which this PR goes green on a re-run. This also unblocks every future Dependabot PR, which is the durable fix.
2. Or merge this one accepting the two red governance checks, as #1431 did — the pattern MERGE_POLICY.md line 162 flags as checks "laundering themselves as enforcement".

Not auto-merging: base main is protected, there is no automerge label, and MERGE_POLICY.md adoption step 6 (Enable Class A auto-merge) has not shipped. Not pushing to this branch either — doing so would detach Dependabot from managing the PR.

Staged command once #1423 lands:

gh pr checks 1433 --watch     # confirm the two governance checks flip green
gh pr merge 1433 --squash

---

Generated by Claude Code

[groupthinking]

Review — no objection on the merits; blocked only by an unsatisfiable gate

Reviewed at head dff2ba6. Both hunks check out. The one thing standing between this and merge is a required check Dependabot has no way to pass.

The bump itself

• Integrity hash verified against the registry, not taken from the PR body. registry.npmjs.org/js-yaml/4.3.1 returns sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ== — byte-identical to the lockfile entry.
• Patch release, single upstream commit (c3cc4b0), no API surface change.

Exposure is narrower than the "Security" label suggests

Worth recording so this isn't treated as urgent:

• js-yaml is not declared in any package.json in the repo — it is transitive only.
• No source file imports it: no from 'js-yaml' / require('js-yaml') anywhere in *.ts, *.tsx, *.js, *.mjs.
• The lock entry carries "dev": true, so it never reaches a production bundle.

The upstream fix removes quadratic complexity from !!omap duplicate-key detection. Reaching it requires parsing untrusted YAML containing !!omap, at build/test time only. Low urgency — but the patch is a strict improvement at zero cost, so there's no reason not to take it.

The second hunk is a stale-lock correction, not drift

The diff also moves tailwindcss ^4.3.2 → ^4.3.3 in the apps/web devDependencies mirror. That looks like unrelated drift and is not — it's the lockfile catching up to the manifest:

File	tailwindcss range
apps/web/package.json @ main	^4.3.3
apps/web/package.json @ this branch	^4.3.3 (untouched)
package-lock.json @ main	^4.3.2 ← stale

No package.json is modified by this PR (git diff --stat = package-lock.json only), and no resolved tailwindcss version changes — only the recorded range. npm install corrected a desync that already existed on main.

Flagging one consequence: #1381 explicitly reverted this same correction "to keep this PR surgical," which is why main is still out of sync. Reverting it again here would just preserve the desync. Recommend letting it land.

Sole blocker

PR Governance and Canonical issue and evidence are red. Everything else — 22 of 24 checks — is green.

The failure text is:

## Canonical issue is missing …; ## Outcome is missing …; ## Risk is missing …; ## Verification is missing …; ## Production evidence is missing …; exactly one closing reference is required: Closes #<issue>

Dependabot composes its body from a fixed template and cannot emit those five headings or a Closes #<issue> reference. This is not a bar it failed — it's one it has no mechanism to clear, so no amount of rebasing or recreating this PR will turn it green.

#1423 fixes exactly this: it returns neutral for dependabot[bot] (not success — the contract is inapplicable, not satisfied), with behavioural tests asserting a human author with the same body still fails. It is currently in draft. Merging it is the prerequisite for this PR and for #1171.

Recommendation

Merge #1423 first, then this one. No changes requested here.

---

Generated by Claude Code

[groupthinking]

Blocker cleared — HALTED(ci_failing) above is now stale

#1423 landed (it's on main at 294493c), and Dependabot rebased this PR onto it at 20:47. The prediction in my earlier comment is now confirmed against the new head d6c91a4 rather than left as a claim:

Check	Before (dff2ba6)	After (d6c91a4)
Canonical issue and evidence	❌ failure	✅ success
PR Governance	❌ failure	⚪ neutral

PR Governance publishing neutral rather than success is the correct outcome, not a near-miss — #1423 deliberately distinguishes not applicable from satisfied, so the check does not launder an exemption as enforcement. That was the design intent and it held.

Remaining checks are the routine matrix (build, test, lint-*, trivy, npm-audit, Security Scan - javascript, coverage) — all queued or in progress at time of writing, none failing. Already green on this head: validate, guards, bandit, python-safety, gitleaks, dependency-review, Vercel.

Disposition

Moves from HALTED(ci_failing) to HALTED(awaiting_merge_approval) — no longer blocked on anything an agent can fix, and no longer blocked on a second PR.

Still not merging: main is protected, there is no automerge label, and MERGE_POLICY.md adoption step 6 (Enable Class A auto-merge) has not shipped. The change itself is js-yaml 4.3.0 → 4.3.1, a dev-dependency patch confined to package-lock.json — Class A, with dependency-review reporting no vulnerability, license, or Scorecard issues.

gh pr checks 1433 --watch     # confirm the remaining matrix goes green
gh pr merge 1433 --squash

Worth noting the durable win: this gate was unsatisfiable for every Dependabot PR, not just this one. #1459 (hono 4.12.32 → 4.13.1) opened after #1423 landed and is not hitting it.

---

Generated by Claude Code