fix(deps): update js-yaml to 3.14.2 (CVE fix)

[Copilot]

Updates js-yaml from 3.14.1 to 3.14.2 to fix GHSA-mh29-5h37-fv8m (MODERATE, CVSS 5.3) - prototype pollution in merge (<< operator).

Dependency path:

ts-jest → @jest/transform → babel-plugin-istanbul → @istanbuljs/load-nyc-config → js-yaml@3.14.1

Transitive dev dependency used by Jest for code coverage. Changes limited to package-lock.json (version, resolved URL, integrity hash).

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Security] js-yaml security update ready for merge</issue_title>
<issue_description>## Security Update Summary

A MODERATE severity security vulnerability has been identified and fixed in js-yaml:

• Package: js-yaml
• Current Version: 3.14.1
• Fixed Version: 3.14.2
• Severity: MODERATE (CVSS 5.3)
• CVE: GHSA-mh29-5h37-fv8m
• Issue: Prototype pollution in merge (<< operator)

Verification Status

✅ All checks passed:

• Build successful (npm run build)
• All 643 tests passing
• Linting passed (existing warnings only)
• No runtime dependencies affected
• npm audit now shows 0 vulnerabilities

Changes Made

The fix has been committed to branch deps/security-update-20260125:

• Commit: 5d50bfe
• Files changed: 1 (package-lock.json)
• Lines changed: 3 (version, URL, integrity hash)

Impact Analysis

This is a transitive dev dependency used by Jest for code coverage:

ts-jest → @jest/transform → babel-plugin-istanbul → @istanbuljs/load-nyc-config → js-yaml@3.14.1

While it only affects development/testing, fixing it improves the security posture of the codebase.

Action Required

Option 1: Create PR manually

git fetch origin deps/security-update-20260125
git checkout deps/security-update-20260125
gh pr create --base main --title "fix(deps): update js-yaml to 3.14.2 (CVE fix)" --body "Fixes GHSA-mh29-5h37-fv8m"

Option 2: Apply patch directly

npm audit fix --force
npm test  # Verify
git commit -am "fix(deps): update js-yaml to 3.14.2 (CVE fix)"

Additional Context

• Release Date: js-yaml 3.14.2 was released November 14, 2025 (2 months old)
• Advisory: GHSA-mh29-5h37-fv8m
• Detailed Report: See workflow run 21333415629

---

Note: The dependency security monitor workflow attempted to create a PR automatically but lacks push permissions. This issue was created instead to track the manual merge.

AI generated by Dependency Security Monitor

• expires on Jan 26, 2026, 7:37 PM UTC

Comments on the Issue (you are @copilot in this section)

• Fixes [Security] js-yaml security update ready for merge #413

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	77.98%	77.98%	➡️ +0.00%
Statements	78.05%	78.05%	➡️ +0.00%
Functions	77.77%	77.77%	➡️ +0.00%
Branches	71.70%	71.70%	➡️ +0.00%

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

Smoke Test Results ✅

Last 2 Merged PRs:

• chore: remove unused release workflow files #423: chore: remove unused release workflow files
• feat(cli): replace --agent-base-image with --agent-image option #397: feat(cli): replace --agent-base-image with --agent-image option

Test Results:

• ✅ GitHub MCP (PR search)
• ✅ Playwright (GitHub title verified)
• ✅ File creation
• ✅ Bash tool

Status: PASS

@Copilot @Mossaka

AI generated by Smoke Copilot

[github-actions]

Smoke Test Results

Last 2 Merged PRs:

• chore: remove unused release workflow files #423: chore: remove unused release workflow files
• feat(docker): propagate host.docker.internal DNS to spawned containers #210: feat(docker): propagate host.docker.internal DNS

✅ GitHub MCP
✅ Playwright (page title: "GitHub · Change is constant...")
✅ File Writing
✅ Bash Tool

Status: PASS

AI generated by Smoke Claude