From e52e9e70764e0d3ad43ad25538669ae91b5f0f9c Mon Sep 17 00:00:00 2001
From: Pattern Security Automation <github-security-automation@pattern.com>
Date: Sun, 26 Jul 2026 04:53:33 -0600
Subject: [PATCH] fix(security): bump js-yaml to 4.3.0 [manual lock regen
 required]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CVE: CVE-2026-59869
Lock regen timed out — see PR description.
---
 web/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/package.json b/web/package.json
index 199083d0..22e04c83 100644
--- a/web/package.json
+++ b/web/package.json
@@ -20,7 +20,7 @@
     "@patterninc/react-ui": "^5.0.3",
     "@tanstack/react-query": "^5.66.11",
     "@tanstack/react-query-devtools": "^5.66.11",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.3.0",
     "moment": "^2.30.1",
     "moment-timezone": "^0.6.0",
     "next": "^16.1.6",