chore(deps): bump js-yaml from 4.2.0 to 5.2.1 in /frontend

[dependabot]

Bumps js-yaml from 4.2.0 to 5.2.1.

Changelog

Sourced from js-yaml's changelog.

[5.2.1] - 2026-07-02

Fixed

• Add Map support to !!omap (should work when realMapTag used)

Security

• Remove quadratic complexity from !!omap addItem. Regression from v5 (usually not critical, because YAML11_SCHEMA is not default anymore).

4.3.0, 3.15.0 - 2026-06-27

Security

• Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
• Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

• maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

• Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

• Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

• [breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

• Added named exports for schemas, tags, parser events and AST utilities.
• Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.
• Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.
• Added dump() transform option for changing the generated AST before rendering.
• Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and

... (truncated)

Commits

• ac16b42 5.2.1 released
• 4a864e5 Deps bump
• 39f3211 !!omap: add Map support and remove quadratic complexity
• ff17f1e Changelog update
• 8ed15f1 deps bump
• 1a562dc Fix changelog link
• c28ed5e 5.2.0 released
• 125cd5a Add maxAliases option
• 3105455 Replace maxMergeSeqLengthoption with maxTotalMergeKeys (more robust)
• 39d00d6 numbers: Drop boxed numbers support, simplify .identify() checks, clarify rou...
• Additional commits viewable in compare view

[greptile-apps]

Greptile Summary

This PR updates the frontend YAML parser dependency. The main change is:

• frontend/package.json now requires js-yaml ^5.2.1.

Confidence Score: 4/5

This should be fixed before merging.

• The frontend manifest and pnpm lockfile still disagree on the js-yaml version.
• Frozen installs can fail before the app builds.
• Non-frozen installs can create uncommitted lockfile changes.

frontend/package.json and pnpm-lock.yaml

Security Review

This dependency update is security-related, but the committed lockfile still does not include the upgraded frontend dependency.

Important Files Changed

Filename	Overview
frontend/package.json	Updates the direct js-yaml dependency for the frontend.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
frontend/package.json:34
**Lockfile still stale** The frontend manifest now asks for `js-yaml` `^5.2.1`, but the committed pnpm lockfile still records the frontend importer with the old `^4.1.1` specifier and `4.2.0` resolution. A frozen pnpm install can fail with an outdated-lockfile error, and a non-frozen install will rewrite the dependency graph locally. Please regenerate and commit the pnpm lockfile for this dependency bump.

_{Reviews (2): Last reviewed commit: "chore(deps): bump js-yaml from 4.2.0 to ..." | Re-trigger Greptile}

[greptile-apps]

Lockfile Still Resolves Old Version

This manifest now requires js-yaml ^5.2.1, but the pnpm lockfile still records the frontend importer with the old ^4.1.1 specifier and 4.2.0 resolution. A frozen pnpm install can fail on the stale lockfile, while a non-frozen install will produce an uncommitted lockfile change instead of using the committed dependency graph.

Prompt To Fix With AI

This is a comment left during a code review.
Path: frontend/package.json
Line: 34

Comment:
**Lockfile Still Resolves Old Version**

This manifest now requires `js-yaml` `^5.2.1`, but the pnpm lockfile still records the frontend importer with the old `^4.1.1` specifier and `4.2.0` resolution. A frozen pnpm install can fail on the stale lockfile, while a non-frozen install will produce an uncommitted lockfile change instead of using the committed dependency graph.

How can I resolve this? If you propose a fix, please make it concise.

[greptile-apps]

Lockfile still stale The frontend manifest now asks for js-yaml ^5.2.1, but the committed pnpm lockfile still records the frontend importer with the old ^4.1.1 specifier and 4.2.0 resolution. A frozen pnpm install can fail with an outdated-lockfile error, and a non-frozen install will rewrite the dependency graph locally. Please regenerate and commit the pnpm lockfile for this dependency bump.

Prompt To Fix With AI

This is a comment left during a code review.
Path: frontend/package.json
Line: 34

Comment:
**Lockfile still stale** The frontend manifest now asks for `js-yaml` `^5.2.1`, but the committed pnpm lockfile still records the frontend importer with the old `^4.1.1` specifier and `4.2.0` resolution. A frozen pnpm install can fail with an outdated-lockfile error, and a non-frozen install will rewrite the dependency graph locally. Please regenerate and commit the pnpm lockfile for this dependency bump.

How can I resolve this? If you propose a fix, please make it concise.