diff --git a/packages/cli/package.json b/packages/cli/package.json
index 85d87bb..fab8221 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -33,7 +33,7 @@
     "envinfo": "7.21.0",
     "listr2": "10.2.1",
     "write-file-atomic": "7.0.1",
-    "yaml": "2.8.3"
+    "yaml": "2.8.4"
   },
   "devDependencies": {
     "@types/node": "25.6.0",
diff --git a/packages/frameworks/package.json b/packages/frameworks/package.json
index 81f58a3..c5c59e4 100644
--- a/packages/frameworks/package.json
+++ b/packages/frameworks/package.json
@@ -21,7 +21,7 @@
   "dependencies": {
     "@iarna/toml": "2.2.5",
     "@opencodehub/core-types": "workspace:*",
-    "yaml": "2.8.3",
+    "yaml": "2.8.4",
     "zod": "4.3.6"
   },
   "devDependencies": {
diff --git a/packages/policy/package.json b/packages/policy/package.json
index 1646852..090ebfe 100644
--- a/packages/policy/package.json
+++ b/packages/policy/package.json
@@ -21,7 +21,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "yaml": "2.8.3",
+    "yaml": "2.8.4",
     "zod": "4.3.6"
   },
   "devDependencies": {
diff --git a/packages/sarif/package.json b/packages/sarif/package.json
index c4cbf6e..ebb11ef 100644
--- a/packages/sarif/package.json
+++ b/packages/sarif/package.json
@@ -24,7 +24,7 @@
   },
   "dependencies": {
     "@types/sarif": "2.1.7",
-    "yaml": "2.8.3",
+    "yaml": "2.8.4",
     "zod": "4.3.6"
   },
   "devDependencies": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index e72e66f..f3aeca0 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -138,8 +138,8 @@ importers:
         specifier: 7.0.1
         version: 7.0.1
       yaml:
-        specifier: 2.8.3
-        version: 2.8.3
+        specifier: 2.8.4
+        version: 2.8.4
     devDependencies:
       '@types/node':
         specifier: 25.6.0
@@ -207,8 +207,8 @@ importers:
         specifier: workspace:*
         version: link:../core-types
       yaml:
-        specifier: 2.8.3
-        version: 2.8.3
+        specifier: 2.8.4
+        version: 2.8.4
       zod:
         specifier: 4.3.6
         version: 4.3.6
@@ -397,8 +397,8 @@ importers:
   packages/policy:
     dependencies:
       yaml:
-        specifier: 2.8.3
-        version: 2.8.3
+        specifier: 2.8.4
+        version: 2.8.4
       zod:
         specifier: 4.3.6
         version: 4.3.6
@@ -416,8 +416,8 @@ importers:
         specifier: 2.1.7
         version: 2.1.7
       yaml:
-        specifier: 2.8.3
-        version: 2.8.3
+        specifier: 2.8.4
+        version: 2.8.4
       zod:
         specifier: 4.3.6
         version: 4.3.6
@@ -1753,6 +1753,7 @@ packages:
   '@smithy/util-retry@4.3.6':
     resolution: {integrity: sha512-p6/FO1n2KxMeQyna067i0uJ6TSbb165ZhnRtCpWh4Foxqbfc6oW+XITaL8QkFJj3KFnDe2URt4gOhgU06EP9ew==}
     engines: {node: '>=18.0.0'}
+    deprecated: '@smithy/util-retry v4.3.6 contains a bug in Adaptive Retry, see https://github.com/smithy-lang/smithy-typescript/issues/1993. Upgrade to 4.3.7+'
 
   '@smithy/util-stream@4.5.24':
     resolution: {integrity: sha512-na5vv2mBSDzXewLEEoWGI7LQQkfpmFEomBsmOpzLFjqGctm0iMwXY5lAwesY9pIaErkccW0qzEOUcYP+WKneXg==}
@@ -4124,8 +4125,8 @@ packages:
     resolution: {integrity: sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==}
     engines: {node: '>=18'}
 
-  yaml@2.8.3:
-    resolution: {integrity: sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==}
+  yaml@2.8.4:
+    resolution: {integrity: sha512-ml/JPOj9fOQK8RNnWojA67GbZ0ApXAUlN2UQclwv2eVgTgn7O9gg9o7paZWKMp4g0H3nTLtS9LVzhkpOFIKzog==}
     engines: {node: '>= 14.6'}
     hasBin: true
 
@@ -7644,7 +7645,7 @@ snapshots:
       simple-git: 3.36.0
       strip-ansi: 7.2.0
       uuid: 14.0.0
-      yaml: 2.8.3
+      yaml: 2.8.4
       zod: 3.25.76
     transitivePeerDependencies:
       - '@types/node'
@@ -8337,7 +8338,7 @@ snapshots:
 
   yallist@5.0.0: {}
 
-  yaml@2.8.3: {}
+  yaml@2.8.4: {}
 
   yargs-parser@21.1.1: {}