From 83522d1e81dde051b9cacf3c10f05d176ad0d9c9 Mon Sep 17 00:00:00 2001
From: Steve Smith <scsmith@users.noreply.github.com>
Date: Thu, 30 Jul 2026 14:40:20 +0100
Subject: [PATCH] Bump js-yaml to 4.3.0 (transitive, via eslint)

Fixes GHSA-52cp-r559-cp3m / CVE-2026-59869 (quadratic CPU on chained
YAML merge keys), dependabot alert #82. Dev-only dependency.
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index aaf786b..77ff3c6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3972,9 +3972,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
       "dev": true,
       "funding": [
         {