fix(ci): bump js-yaml override to 4.3.0 to clear osv-scan GHSA-52cp-r559-cp3m

[cursor]

Relevant issues

• osv-scan started failing on every PR run after GHSA-52cp-r559-cp3m (js-yaml 4.2.0, High 7.5, npm dev dep of the dashboard) entered the OSV database; the fix release 4.3.0 is out
• js-yaml is already listed in overrides in ui/litellm-dashboard/package.json, so bumping the pinned version there plus mirroring the resolved/integrity for the single node_modules/js-yaml entry in package-lock.json is all that's needed; npm ci --dry-run validates the lockfile
• companion to fix(ci): bump brace-expansion to 5.0.7 to clear osv-scan GHSA-3jxr-9vmj-r5cp #34032 which clears the other outstanding osv-scan flag (brace-expansion GHSA-3jxr-9vmj-r5cp); with both merged, osv-scan is clean on litellm_internal_staging

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Screenshots / Proof of Fix

Ran the same osv-scanner v2.3.8 invocation the workflow uses locally against this branch. Before the bump (litellm_internal_staging @ eb27447), osv-scan reports two flags; after the bump the js-yaml row is gone and only the brace-expansion flag remains (already fixed by #34032):

$ /tmp/osv-scanner scan source --config osv-scanner.toml -L uv.lock -L ui/litellm-dashboard/package-lock.json
Total 1 package affected by 1 known vulnerability (0 Critical, 1 High, 0 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
1 vulnerability can be fixed.

+-------------------------------------+------+-----------+-----------------------+---------+---------------+----------------------------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE               | VERSION | FIXED VERSION | SOURCE                                 |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+----------------------------------------+
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev) | 5.0.6   | 5.0.7         | ui/litellm-dashboard/package-lock.json |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+----------------------------------------+

Type

🚄 Infrastructure

Changes

• ui/litellm-dashboard/package.json: overrides.js-yaml 4.2.0 -> 4.3.0
• ui/litellm-dashboard/package-lock.json: node_modules/js-yaml version/resolved/integrity updated to match 4.3.0; nothing else touched

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing cursor/ci-autofix-automation-3d4c (6e9d8ca) with litellm_internal_staging (214945a)¹}

Footnotes

1. No successful run was found on litellm_internal_staging (eb27447) during the generation of this report, so 214945a was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩