chore(deps): update js-yaml for CVE-2026-59870

[Alejandro Lopez (soyalejolopez)]

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

Category

• Bug fix
• New script
• New sample

Related Issues

Resolves Dependabot alert #155 for CVE-2026-59870 (GHSA-5p4m-2wfm-xmqj).

What's in this Pull Request?

Updates the direct js-yaml dependency to 5.2.3 and gray-matter's transitive dependency from vulnerable 3.15.0 to the first patched 3.x release, 3.15.1.

Validation

npm audit --audit-level=high reports 0 vulnerabilities; before the update it identified GHSA-5p4m-2wfm-xmqj.

npm run check validates all 30 catalog resources.

[github-actions]

🛰️ PR Sweeper report

Risk: 🟢 LOW · Security gate: ✅ passing · Files: 2

🔒 Automated guardrails (authoritative)

No secret, PII, file-policy, or scope issues detected. ✅

🤖 Dual-model AI review (advisory)

AI review unavailable for this run (models not reachable or no diff). Guardrails above are unaffected.

• GPT-class reviewer (openai/gpt-5): skipped — GitHub Models HTTP 410: {"error":{"code":"github_models_retirement_brownout","message":"GitHub Models is temporarily unavailable as part of a scheduled retirement brownout."}}

• Deep-reasoning reviewer (openai/o3): skipped — GitHub Models HTTP 410: {"error":{"code":"github_models_retirement_brownout","message":"GitHub Models is temporarily unavailable as part of a scheduled retirement brownout."}}

---

The automated guardrails are authoritative and gate the security status. The AI review is advisory and never auto-merges. Thanks for contributing to FastTrack! 🛩️