fix(deps): pin js-yaml override to 4.x to unbreak semantic-release

[prisis]

Urgent — releases are broken on main

The Semantic Release workflow is failing (run) with:

SyntaxError: The requested module 'js-yaml' does not provide an export named 'default'

Cause

The audit-fix override js-yaml@>=4.0.0 <4.3.0: ">=4.3.0" is unbounded above, so pnpm resolved js-yaml 5.x — which is ESM-only with no default export. multi-semantic-release does import b from "js-yaml", so package loading throws and every publish fails.

Fix

Bound the override to ^4.3.0 (>=4.3.0 <5.0.0). Still patches GHSA-52cp-r559-cp3m, but keeps js-yaml on 4.x with its default export.

Verified

• pnpm exec multi-semantic-release --dry-run loads every package again (no SyntaxError)
• pnpm audit --audit-level=moderate → no known vulnerabilities

🤖 Generated with Claude Code

https://claude.ai/code/session_014Hm4zrh4o8w3Qcs24BvpV9

Summary by CodeRabbit

• Chores
  • Updated YAML processing dependency rules to remain on the compatible 4.x release line.
  • Added documentation clarifying the version constraint and compatibility considerations.

[github-actions]

Thank you for following the naming conventions! 🙏

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 61da1fb9-abbe-45f9-8c01-5cc504cc0614

📥 Commits

Reviewing files that changed from the base of the PR and between 6aa21f9 and fa6371e.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

---

📝 Walkthrough

Walkthrough

The workspace override for js-yaml now uses ^4.3.0 instead of a lower-bound range, with comments documenting the required 4.x compatibility and multi-semantic-release patching behavior.

Changes

js-yaml override

Layer / File(s)	Summary
Update js-yaml override rule pnpm-workspace.yaml	The js-yaml override now uses ^4.3.0, with comments explaining the 4.x-only constraint and patching expectation.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the js-yaml override pin to 4.x to keep semantic-release working.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/js-yaml-override-release

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[prisis]

Superseded by #1071 (merged as db9bb06), which contains this exact js-yaml ^4.3.0 fix plus the consolidated dependency updates. This standalone PR's Preview Release also fails because it predates the svgo + other override bumps that #1071 adds. Closing as included.