chore(UI deps): bump js-yaml to 4.3.0 to fix CVE-2026-59869

[aali309]

Fixes: CVE-2026-59869

Checklist:

• Either (a) I've created an enhancement proposal and discussed it with the community, (b) this is a bug fix, or (c) this does not need to be in the release notes.
• The title of the PR states what changed and the related issues number (used for the release note).
• The title of the PR conforms to the Title of the PR
• I've included "Closes [ISSUE #]" or "Fixes [ISSUE #]" in the description to automatically close the associated issue.
• I've updated both the CLI and UI to expose my feature, or I plan to submit a second PR with them.
• Does this PR require documentation updates?
• I've updated documentation as required by this PR.
• I have signed off all my commits as required by DCO
• I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
• My build is green (troubleshooting builds).
• My new feature complies with the feature status guidelines.
• I have added a brief description of why this PR is necessary and/or what this PR solves.
• Optional. My organization is added to USERS.md.
• Optional. For bug fixes, I've indicated what older releases this fix should be cherry-picked into (this may or may not happen depending on risk/complexity).

[bunnyshell]

❗ Preview Environment deployment failed on Bunnyshell

See: Environment Details | Pipeline Logs

Available commands (reply to this comment):

• 🚀 /bns:deploy to redeploy the environment
• ❌ /bns:delete to remove the environment

[qodo-code-review]

PR Summary by Qodo

Bump UI js-yaml to 4.3.0 and pin overrides to remediate CVE-2026-59869

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Upgrade UI dependency js-yaml to 4.3.0 to address CVE-2026-59869.
• Add pnpm overrides to pin both js-yaml v3 and v4 consumers to patched versions.
• Regenerate pnpm lockfile to reflect the resolved dependency graph.

Diagram

graph TD
  A["UI build/install"] --> B["ui/package.json"] --> C["pnpm overrides"] --> D["js-yaml 4.3.0"]
  C --> E["js-yaml 3.15.0"]
  B --> F["ui/pnpm-lock.yaml"] --> D
  F --> E
  subgraph Legend
    direction LR
    _proc[Process] ~~~ _file["Config/lock file"] ~~~ _dep{{Dependency}}
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Only bump direct js-yaml dependency (no overrides)

• ➕ Simpler package.json (fewer override rules)
• ➕ Lets the resolver choose compatible transitive versions automatically
• ➖ May not remediate CVE for transitive consumers still pulling vulnerable js-yaml majors
• ➖ Remediation becomes dependent on upstream transitive dependency updates

2. Eliminate js-yaml v3 usage by upgrading/removing v3-dependent transitive packages

• ➕ Reduces long-term maintenance and override complexity
• ➕ Converges on a single major version of js-yaml
• ➖ Larger scope change; may require broader dependency upgrades and UI regression validation
• ➖ Higher risk of breaking changes vs. targeted security patch

Recommendation: Current approach (bump js-yaml to 4.3.0 and explicitly override both v3 and v4 ranges to patched versions) is the most reliable, minimal-scope remediation for a security CVE when transitive dependencies may still require v3. Keep the overrides until upstream dependencies stop requiring js-yaml@^3, then remove the v3 pin.

Files changed (2) +18 / -37

Other (2) +18 / -37

package.jsonUpgrade js-yaml and add pnpm overrides for v3/v4 pins +4/-2

Upgrade js-yaml and add pnpm overrides for v3/v4 pins

• Bumps the UI's direct js-yaml dependency to ^4.3.0. Adds pnpm overrides to force patched versions for both js-yaml@^3 (3.15.0) and js-yaml@^4 (4.3.0), ensuring transitive consumers are also remediated.

ui/package.json

pnpm-lock.yamlLockfile refresh to resolve js-yaml to patched versions +14/-35

Lockfile refresh to resolve js-yaml to patched versions

• Updates the lockfile to reflect js-yaml 4.3.0 for v4 consumers and 3.15.0 for v3 consumers, including new override entries and snapshot/package resolution changes.

ui/pnpm-lock.yaml

[Copilot]

Pull request overview

This PR updates the UI’s js-yaml dependency to address CVE-2026-59869, and adds pnpm overrides to ensure both js-yaml@^4 and transitive js-yaml@^3 consumers resolve to patched versions.

Changes:

• Bump UI direct dependency js-yaml to ^4.3.0.
• Add pnpm overrides for js-yaml@^3 → 3.15.0 and js-yaml@^4 → 4.3.0.
• Update pnpm-lock.yaml resolutions accordingly.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
ui/package.json	Bumps js-yaml to ^4.3.0 and adds pnpm overrides for js-yaml v3/v4.
ui/pnpm-lock.yaml	Updates lockfile to reflect the new js-yaml resolutions and overrides.

Files not reviewed (1)

• ui/pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 13 rules

---

🔴 Action Required

1. Lockfile specifier mismatch ✓ Resolved 🐞 ☼ Reliability

Description

ui/pnpm-lock.yaml records js-yaml with an exact manifest specifier (4.3.0) while ui/package.json
declares ^4.3.0, so pnpm installs with frozen lockfile validation can fail as “lockfile is out of
date”. This is a deterministic CI/reproducibility break for environments using --frozen-lockfile (or
equivalent).

Code

ui/pnpm-lock.yaml[R63-65]

      js-yaml:
-        specifier: ^4.1.1
-        version: 4.2.0
+        specifier: 4.3.0
+        version: 4.3.0

Relevance

⭐⭐⭐ High

Team enforces --frozen-lockfile for deterministic installs; lockfile/manifest mismatch likely
treated as CI-breaking bug.

PR-#27099
PR-#23937

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The manifest declares a caret range, but the lockfile importer section stores an exact specifier for
the same dependency, which pnpm treats as a lockfile/manifest mismatch under frozen-lockfile
validation.

ui/package.json[14-31]
ui/pnpm-lock.yaml[19-66]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`ui/package.json` declares `js-yaml` as `^4.3.0`, but `ui/pnpm-lock.yaml` importer entry shows `specifier: 4.3.0`. pnpm expects the lockfile importer `specifier` to match the package.json specifier; otherwise `pnpm install --frozen-lockfile` will error.

### Issue Context
This PR changed both the manifest and lockfile, but left `js-yaml`'s importer specifier inconsistent with the manifest.

### Fix Focus Areas
- ui/package.json[24-70]
- ui/pnpm-lock.yaml[58-66]

### Suggested fix
Either:
1) Re-run `pnpm install` (with the repo’s pnpm version) so `ui/pnpm-lock.yaml` is regenerated and its importer `specifier` becomes `^4.3.0`, **or**
2) If you intended to pin exactly, change `ui/package.json` dependency to `"js-yaml": "4.3.0"` to match the lockfile.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ℹ️ Informational

2. Override defeats caret range ✓ Resolved 🐞 ⚙ Maintainability

Description

The added pnpm override forces js-yaml@^4 to resolve to exactly 4.3.0, which defeats the declared
dependency range (^4.3.0) and prevents future compatible v4 patch/minor updates unless the override
is manually updated. This increases ongoing maintenance burden for dependency updates.

Code

ui/package.json[R64-70]

      "normalize-url": "4.5.1",
      "rxjs": "6.6.7",
      "formidable": "2.1.3",
-      "dompurify": "3.4.0"
+      "dompurify": "3.4.0",
+      "js-yaml@^3": "3.15.0",
+      "js-yaml@^4": "4.3.0"
    }

Relevance

⭐ Low

Repo historically pins deps/uses overrides for stability (pnpm migration pinned packages); exact
override likely acceptable.

PR-#23937

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The same file declares a caret range for js-yaml but also adds an override that pins all matching v4
resolutions to an exact version, which changes how pnpm resolves and updates dependencies.

ui/package.json[14-31]
ui/package.json[60-70]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`pnpm.overrides` includes `"js-yaml@^4": "4.3.0"` while dependencies declare `"js-yaml": "^4.3.0"`. The override wins and effectively pins all v4 resolutions to exactly `4.3.0`, blocking automatic upgrades to later `4.x` versions.

### Issue Context
Exact pins can be intentional for a targeted CVE fix, but they also prevent picking up subsequent non-breaking fixes unless someone remembers to update the override.

### Fix Focus Areas
- ui/package.json[60-70]

### Suggested fix
If you want to allow future v4 updates, change the override to a range (e.g., `"js-yaml@^4": "^4.3.0"`) or remove the override for v4 entirely if it’s redundant with the direct dependency.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

---

Powered by Qodo

[qodo-code-review]

1. Lockfile specifier mismatch 🐞 Bug ☼ Reliability

ui/pnpm-lock.yaml records js-yaml with an exact manifest specifier (4.3.0) while ui/package.json
declares ^4.3.0, so pnpm installs with frozen lockfile validation can fail as “lockfile is out of
date”. This is a deterministic CI/reproducibility break for environments using --frozen-lockfile (or
equivalent).

Agent Prompt

### Issue description
`ui/package.json` declares `js-yaml` as `^4.3.0`, but `ui/pnpm-lock.yaml` importer entry shows `specifier: 4.3.0`. pnpm expects the lockfile importer `specifier` to match the package.json specifier; otherwise `pnpm install --frozen-lockfile` will error.

### Issue Context
This PR changed both the manifest and lockfile, but left `js-yaml`'s importer specifier inconsistent with the manifest.

### Fix Focus Areas
- ui/package.json[24-70]
- ui/pnpm-lock.yaml[58-66]

### Suggested fix
Either:
1) Re-run `pnpm install` (with the repo’s pnpm version) so `ui/pnpm-lock.yaml` is regenerated and its importer `specifier` becomes `^4.3.0`, **or**
2) If you intended to pin exactly, change `ui/package.json` dependency to `"js-yaml": "4.3.0"` to match the lockfile.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[codecov]

Bundle Report

Bundle size has no change ✅

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• ui/pnpm-lock.yaml: Generated file

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• ui/pnpm-lock.yaml: Generated file

Comments suppressed due to low confidence (1)

ui/pnpm-lock.yaml:63

• The lockfile still includes js-yaml@4.1.1 (and 3.x) as transitive dependencies (e.g., @redocly/openapi-core depends on js-yaml 4.1.1), so bumping the top-level js-yaml specifier alone may not fully eliminate older js-yaml versions from the install. If the CVE affects those older versions, consider adding a pnpm override for js-yaml and/or updating the transitive dependency that pins 4.1.1, then re-generating the lockfile.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• ui/pnpm-lock.yaml: Generated file

[aali309]

updated

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• ui/pnpm-lock.yaml: Generated file

Comments suppressed due to low confidence (1)

ui/pnpm-lock.yaml:65

• pnpm-lock.yaml is out of sync with ui/package.json: the importer entry for js-yaml records specifier: 4.3.0, but the manifest declares "js-yaml": "^4.3.0". This mismatch can cause pnpm install --frozen-lockfile to fail or force a lockfile rewrite in CI.

[keithchong]

@aali309 was this set after the lock file was regenerated? The suggestion was to have it set to ^4.3.0

[aali309]

The broad override js-yaml@^4 → 4.3.0 made pnpm rewrite the lockfile to exact 4.3.0. I had pinned package.json to match that, which broke consistency with the other deps.