build(deps): bump h2 to 4.4.1 and js-yaml to 4.3.1

[yuneng-berri]

Clears both findings from the current osv-scan against litellm_internal_staging, bundled into one PR so the scan goes green on a single merge.

Advisory	CVSS	Package	Bump	Lockfile
GHSA-6hr6-w5qg-qmwg	5.3	h2	4.3.0 -> 4.4.1	uv.lock
GHSA-5p4m-2wfm-xmqj	7.5	js-yaml (dev)	4.3.0 -> 4.3.1	ui/litellm-dashboard/package-lock.json

h2

Re-derived with uv lock --upgrade-package h2. Two packages move — h2, plus hpack 4.1.0 -> 4.2.0, which h2 4.4.1 requires. Diff is 14 lines.

This deliberately does not reuse the lockfile from the Dependabot PR for the same advisory, which came in at 388 changed lines because it also rewrote exclude-newer to the degenerate 0001-01-01T00:00:00Z placeholder and stripped python_full_version markers from ~190 dependency entries. Re-locking with the repo's own uv keeps exclude-newer a real timestamp and leaves the markers alone.

js-yaml

js-yaml is not a direct dependency — it arrives via @eslint/eslintrc, knip and @redocly/openapi-core, and is held at an exact version by an npm overrides entry. The override and the lock entry therefore move together; a lock-only bump would be reverted by the next resolve.

Verification

• osv-scanner scan source --config osv-scanner.toml -L uv.lock -L ui/litellm-dashboard/package-lock.json on this branch, using v2.3.8 (the version the workflow pins): No issues found.
• uv lock --check passes.
• npm ci succeeds on the regenerated lock; installed tree resolves js-yaml@4.3.1, and the lock integrity matches the registry value for 4.3.1 exactly.
• npm run lint is unchanged from base — the single pre-existing error (no-restricted-imports on the antd import in vertexCredentialsUpload.ts) is present on litellm_internal_staging and untouched here.
• All three versions clear the repo's 3-day cooldown: h2 4.4.1 published 2026-08-03, hpack 4.2.0 on 2026-06-23, js-yaml 4.3.1 on 2026-07-31.

One finding stays suppressed rather than fixed: GHSA-w8v5-vhqr-4h9v (diskcache unsafe pickle deserialization) is filtered by osv-scanner.toml until 2026-09-09. Upstream still has no fixed release — diskcache 5.6.3 from 2023 is the latest and the advisory covers everything through it. That ignore will need extending or replacing before it expires.

[greptile-apps]

Greptile Summary

This PR updates the dashboard’s pinned, development-only js-yaml override and synchronized lockfile entry from 4.3.0 to 4.3.1

• Updates the exact override in package.json
• Updates the resolved version, archive URL, and integrity hash in package-lock.json
• Leaves all other dependencies unchanged

Confidence Score: 5/5

The PR appears safe to merge because the manifest and lockfile remain synchronized and no changed-code failure was identified

The patch is limited to a matching development dependency override and lock entry update, while existing consumers remain reachable through the same dependency structure

Important Files Changed

Filename	Overview
ui/litellm-dashboard/package.json	Updates the exact js-yaml override to 4.3.1, with no concrete compatibility or installation regression identified
ui/litellm-dashboard/package-lock.json	Synchronizes the locked js-yaml version, registry URL, and integrity metadata with the manifest override

_{Reviews (1): Last reviewed commit: "build(deps-dev): bump js-yaml to 4.3.1" | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_bump_js_yaml_4_3_1 (3a81f90) with litellm_internal_staging (a79d9ba)¹}

Footnotes

1. No successful run was found on litellm_internal_staging (3a81f90) during the generation of this report, so 7ec6c8f was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩