[Deps] Fix js-yaml prototype pollution vulnerability

[github-actions]

Security Fix

This PR addresses a MODERATE severity vulnerability in the js-yaml dependency used by the dev dependency chain.

Vulnerability Details

• Package: js-yaml (via @istanbuljs/load-nyc-config)
• Affected Version: <3.14.2
• Fixed Version: 3.14.2
• Severity: MODERATE
• CVSS Score: 5.3
• CVE: GHSA-mh29-5h37-fv8m
• Issue: Prototype pollution in merge (<<) operator

Impact

This vulnerability is in a dev dependency (@istanbuljs/load-nyc-config → babel-plugin-istanbul → @jest/transform → ts-jest) used for test coverage instrumentation. It does not affect production code.

Changes

• Updated js-yaml from 3.14.1 to 3.14.2 in package-lock.json
• Applied via npm audit fix

Verification

✅ All tests pass: 572 tests passed (18 test suites)
✅ No breaking changes detected
✅ Zero vulnerabilities remain: npm audit reports 0 vulnerabilities

References

• Advisory GHSA-mh29-5h37-fv8m
• js-yaml Security Fix

---

Generated by Dependency Security Monitor Workflow

AI generated by Dependency Security Monitor