chore(deps): collapse stale transitive js-yaml pins onto the patched releases

[waleedlatif1]

Summary

• GHSA-5p4m-2wfm-xmqj (quadratic CPU consumption in !!omap resolution) is patched in js-yaml 4.3.1 and 3.15.1. The advisory prose still says the fix was "never backported" — that text is stale; the backport landed on both legacy lines and the advisory's machine-readable first_patched_version reflects it.
• Both direct dependents (apps/sim, packages/sim-cli) already pin 4.3.1, so the open Dependabot alert is a stale scan and closes on its own.
• bun.lock still held ten vulnerable nested resolutions Dependabot never sees — 4.2.0 ×5, 4.3.0 ×4, 3.14.2 ×1 — under fumadocs (core/mdx/openapi), electron-builder (app-builder-lib, builder-util, dmg-builder), electron-updater, gray-matter, json-schema-to-typescript, and @apidevtools/json-schema-ref-parser.
• Every one of those ranges (^4.1.0, ^4.1.1, ^3.13.1) already admits the patched release, so this is a lockfile-only dedupe — nine entries drop to the hoisted 4.3.1, and gray-matter moves 3.14.2 → 3.15.1. Two js-yaml copies remain, both patched.
• No manifest change and deliberately no overrides block: a flat override would force gray-matter's ^3.13.1 onto js-yaml 4, which removed safeLoad and would break the docs build.

Type of Change

• Bug fix (security / dependency hygiene)

Testing

• Ran the advisory's proof-of-concept against both installed copies. Resolution is linear now — n=150,000 loads in 173 ms (4.3.1) and 191 ms (3.15.1), against the 10.8 s the advisory measured on the vulnerable versions.
• Confirmed on disk that only two js-yaml copies exist and both carry the hasOwnProperty-map resolver rather than the objectKeys.indexOf linear scan.
• bun install --frozen-lockfile resolves and installs cleanly with no lockfile drift.
• Full apps/docs build passes, which exercises the fumadocs and gray-matter YAML paths that moved.
• bun run lint, check-block-registry, and all 29 audits in bun run check:audits pass.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 18, 2026 11:41pm

[cursor]

PR Summary

Low Risk
Dependency lockfile deduplication with no application code changes; versions were already within declared semver ranges and were validated via docs build and advisory PoC timing.

Overview
Lockfile-only update for GHSA-5p4m-2wfm-xmqj (quadratic CPU in js-yaml !!omap resolution). Direct apps already pin 4.3.1; this PR removes nine nested bun.lock entries that still resolved to vulnerable 4.2.0, 4.3.0, or 3.14.2 under fumadocs, electron-builder, electron-updater, json-schema-to-typescript, and @apidevtools/json-schema-ref-parser.

Those transitive ranges already allow patched releases, so installs dedupe to hoisted 4.3.1 except gray-matter, which stays on the v3 line and moves 3.14.2 → 3.15.1 (no overrides forcing v4, which would break safeLoad in docs).

No package.json changes—only bun.lock hygiene so Dependabot-invisible nested copies match the patched resolver behavior already on direct deps.

^{Reviewed by Cursor Bugbot for commit 8367e83. Configure here.}

[waleedlatif1]

@greptile

[greptile-apps]

Greptile Summary

This PR consolidates stale transitive js-yaml resolutions onto patched releases without changing dependency manifests.

• Routes compatible js-yaml 4.x dependents to the existing hoisted 4.3.1 resolution.
• Updates gray-matter’s separate js-yaml 3.x resolution from 3.14.2 to 3.15.1.
• Preserves the major-version boundary required by gray-matter.

Confidence Score: 5/5

The PR appears safe to merge because the retained js-yaml versions satisfy every affected parent range while preserving gray-matter’s required 3.x dependency.

The lockfile deduplication routes nine compatible dependents to js-yaml 4.3.1 and updates gray-matter within its declared 3.x range, with no changed-code failure identified.

Important Files Changed

Filename	Overview
bun.lock	Removes redundant vulnerable js-yaml 4.x resolutions and patches the retained gray-matter-specific 3.x copy; all affected dependency ranges remain satisfied.

_{Reviews (1): Last reviewed commit: "chore(deps): collapse stale transitive j..." | Re-trigger Greptile}