fix: update js-yaml to 4.3.0 to resolve CVE-2026-59869

[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln — test to make sure that nothing is broken, check compatibility, etc.

js-yaml is a transitive dependency (no entry in package.json), so the fix is a lockfile-only bump via npm update js-yaml --package-lock-only. Both dependents already allow the patched range, so no overrides entry was needed.

• Dependency: js-yaml 4.2.0 → 4.3.0 (patch bump, no API changes)
• Advisory: GHSA-52cp-r559-cp3m / CVE-2026-59869 — YAML merge-key chains can force quadratic CPU consumption (high, CVSS 7.5)
• Dependabot alert: https://github.com/warpdotdev/oz-workspace/security/dependabot/132
• Verification:
  • npm install resolves js-yaml@4.3.0
  • npm audit no longer reports js-yaml (remaining findings are unrelated packages tracked by other alerts)
  • npm run build (prisma generate && next build) succeeds
  • npm run lint passes — 6 pre-existing warnings, 0 errors

Highlight the risky code / where the dependency was used

No application code imports js-yaml. It is pulled in only by tooling:

• @eslint/eslintrc (^4.1.1) — dev-time ESLint config loading
• cosmiconfig (^4.1.0) — config file loading

Blast radius is config parsing at build/lint time, not request handling.

Special instructions for this PR — e.g. if it's a Stainless thing

The lockfile diff also contains one incidental "peer": true metadata line added by npm for eslint-plugin-import; that is npm 11 lockfile normalization, not a dependency change.

AFTER YOU MERGE

Nothing. Dependabot alert 132 should auto-close once this lands on main.