[MelvinBot]

Details

Lockfile-only bump of transitive js-yaml to clear open Dependabot alerts (prototype pollution + merge-key / !!omap CPU DoS):

• 3.14.1 → 3.15.2 (via cosmiconfig, from react-native peer CLI / metro-config)
• 4.1.0 → 4.3.2 (via eslint and @eslint/eslintrc, dev only)

Usage: Not imported by src/. Only used by ESLint to read YAML configs, and by RN CLI / Metro config loading. Not shipped in dist.

Change Log

4.3.2

• Hard-limit merge sequence size to 100.
• Security: count empty mappings in merge sequences toward maxTotalMergeKeys.

4.3.1

• Security: remove quadratic complexity from !!omap duplicate key detection.

4.3.0

• Added maxTotalMergeKeys (10000) loader option; replaces maxMergeSeqLength.
• Restore UMD builds to ES5.

4.2.0

• Added maxDepth (100) loader option and docs/safety.md.
• Numbers with underscores no longer resolve as numeric scalars.
• Several parser fixes (flow scalar whitespace folding, block scalar indentation, number round-trip).
• Security: dedupe repeated merge elements (quadratic DoS).

4.1.1

• Security: fix prototype pollution in merge (<<).

3.15.2

• Hard-limit merge sequence size to 100.
• Security: count empty mappings in merge sequences toward maxTotalMergeKeys.

3.15.1

• Security: remove quadratic complexity from !!omap duplicate key detection.

3.15.0

• Added maxTotalMergeKeys (10000) loader option.

3.14.2

• Security: fix prototype pollution in merge (<<).

Related Issues

https://github.com/Expensify/Expensify/issues/695885

Manual Tests

1. npm ci succeeds.
2. npm ls js-yaml shows only 3.15.2 and 4.3.2.
3. npm run lint, npm run ts, and npm run build pass.

Linked PRs

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[chiragsalian]

Archiving this repository so closing out this PR