fix(deps): pin js-yaml to patched release

[seonghobae]

Current compatibility repair

Current head 3f568412da61f12ba36c71765bf915acc8abb85d, tree 21bb392248542c8b8c7b498dd4f2af292d8c1d51, is open and Ready for independent review (not merge-ready). The previous head's Vitest pass did not establish type compatibility: corepack pnpm@11.5.3 --dir frontend exec tsc --noEmit exited 2 with TS1503 at the named capture in frontend/src/dependency-lock.security.test.ts:30.

The two-line fix uses the equivalent numbered capture and ?.[1]; ES2017, the workspace override, and lock bytes remain unchanged (lock blob 018f0382c815ea7a35899e64ddb6c3645399fcb6). Frozen install, focused Vitest (2/2), typecheck and lint passed locally; focused tests and typecheck were repeated on the committed head before the guarded, non-force push. This is local evidence, not terminal hosted checks, independent approval or protected merge. #1562 integrates this complete owner lineage with ordinary merges.

Standalone review-admission receipt (2026-09-06)

The unchanged current head passed frozen install, all 52 frontend files / 439 tests (3.66s), lint/typecheck and whitespace checks. Its own merge ref beaaf7415a9ae57caaff9c53d0cb612924da7ec0, tree 21bb392248542c8b8c7b498dd4f2af292d8c1d51, passed Trivy HIGH/CRITICAL fixable vulnerability/misconfiguration scanning with dev dependencies included (zero findings, report SHA-256 5a0016d6af002ed06cc6ab3425d78d3265f435eddf05db8f171c79fa5097e2bb). No unresolved review threads were returned.

Marked Ready at unchanged head to admit central independent review. The previous instruction to wait for approval while Draft was circular with protected central dispatch policy, which does not dispatch for a live Draft. Hosted checks and qualifying approval remain pending; no source, protection, status or prerequisite was bypassed.

---

Security gap

Dependabot alert #91 reports GHSA-5p4m-2wfm-xmqj against transitive js-yaml@4.3.0 in frontend/pnpm-lock.yaml; the first patched 4.x release is 4.3.1. The current consumer path is ESLint tooling, not shipped runtime UI code.

Intended causal fix

Use the repository's existing pnpm-native overrides policy in frontend/pnpm-workspace.yaml to require js-yaml@4.3.1, then regenerate the pinned lock with repository-required pnpm 11.5.3. No product runtime/API/UI contract should change.

Historical pre-compatibility authority

• base: develop@042b0c70531b229af3acbd0421a2f23098d848b3
• previous dependency head: 23cb8e0eda1e0a29dbb39e1ca98c32a5313d2a0e
• current exact head: c3cf4efc478a264a0a010df82d1ea90b48776610
• lifecycle: Draft / patched dependency + executable lock regression present / deterministic lock regeneration verified / hosted evidence queued
• changed files: frontend/pnpm-workspace.yaml, frontend/pnpm-lock.yaml, frontend/src/dependency-lock.security.test.ts

The dependency slice pins js-yaml: "4.3.1" through the workspace override and lock. Direct child c3cf4efc... adds an executable Vitest contract rather than relying on PR prose: it verifies the workspace and lock metadata pin 4.3.1, rejects any js-yaml@4.3.0 or js-yaml: 4.3.0 occurrence, enumerates the lock's resolved js-yaml package versions, and verifies the ESLint configuration snapshot consumes 4.3.1. The test uses only Node built-ins plus the existing Vitest dependency.

At the historical c3cf4ef head this was source/test evidence, not protected GREEN. Then-current Application CI 33937074325, Security Scan 33937074329, SAST Semgrep 33937074321, CodeQL PR 33937074364, Bandit 33937074330, and Docker 33937074400 are queued. No qualifying independent post-last-push approval has been established.

Deterministic lock regeneration evidence

Pinned pnpm 11.5.3 reproduced the committed lock byte-for-byte with pnpm install --lockfile-only --frozen-lockfile=false (git hash-object frontend/pnpm-lock.yaml = 018f0382c815ea7a35899e64ddb6c3645399fcb6). The resolver therefore necessarily refreshes @eslint/eslintrc 3.3.6→3.3.7, canonicalizes the existing ESLint resolver peer snapshot identities, and records current ESLint deprecation metadata while applying the workspace override. A narrower pnpm update js-yaml@4.3.1 --lockfile-only was rejected because it additionally changed unrelated @napi-rs/wasm-runtime, picomatch, and Vite closure entries. No integrity hash was hand-edited.

The executable Vitest contract passes (2 tests): it requires the 4.3.1 workspace/lock override, enumerates the sole resolved js-yaml version, rejects 4.3.0, and verifies the ESLint consumer snapshot. The repeated regeneration remained byte-clean and git diff --check passed.

Merge boundary

Ready admits independent review; it does not permit merge. Merge only when every then-live repository/organization required check is terminal-success, all valid review threads are resolved, and qualifying independent post-last-push approval exists. No predecessor evidence, self-approval, force push, destructive rebase, dummy requeue commit, or protection bypass applies.

Summary by CodeRabbit

• Security

  • Pinned the frontend’s js-yaml dependency to version 4.3.1.
  • Ensured dependency resolution consistently uses the pinned version and no longer resolves version 4.3.0.

• Tests

  • Added automated checks to verify the dependency lockfile and related configuration remain aligned with the secure version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 5d46cc14-f4c7-42a5-ac26-3b826c7cc101

📥 Commits

Reviewing files that changed from the base of the PR and between 042b0c7 and 3f56841.

⛔ Files ignored due to path filters (1)

• frontend/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• frontend/pnpm-workspace.yaml
• frontend/src/dependency-lock.security.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The frontend workspace pins js-yaml to 4.3.1. A security test verifies the workspace override, lockfile resolutions, absence of 4.3.0, and ESLint snapshot configuration.

Changes

js-yaml security pin

Layer / File(s)	Summary
Pin and validate js-yaml frontend/pnpm-workspace.yaml, frontend/src/dependency-lock.security.test.ts	The workspace override pins js-yaml to 4.3.1. The security test checks workspace metadata, lockfile resolutions, and the ESLint snapshot configuration.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 3f568

The frontend now pins js-yaml to 4.3.1 and adds a contract preventing vulnerable 4.3.0 lockfile references. The dependency metadata and tested consumer path are aligned, with no remaining merge-blocking implementation risk.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: pinning the transitive js-yaml dependency to the patched release.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/js-yaml-4-3-1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh review finding on exact head 23cb8e0eda1e0a29dbb39e1ca98c32a5313d2a0e: the security direction is valid—GHSA-5p4m-2wfm-xmqj affects js-yaml >=4.0.0,<4.3.1 and 4.3.1 is the patched 4.x floor—but the generated lock delta is broader than the stated two-line causal change. frontend/pnpm-lock.yaml also upgrades @eslint/eslintrc 3.3.6→3.3.7, changes several resolver snapshot identities, and refreshes metadata (eslint@9.39.5 deprecation) in addition to js-yaml 4.3.0→4.3.1. Those changes may be benign resolver churn, but they are not established as necessary to remediate this advisory. The current CodeRabbit run explicitly excludes frontend/pnpm-lock.yaml via !**/pnpm-lock.yaml, so that broader delta received no CodeRabbit file review.

Keep Draft. Before merge, either (a) reproduce a minimal pnpm-11.5.3 lock regeneration that changes only the override-required closure, or (b) document and independently verify why each additional transitive/snapshot change is an unavoidable deterministic consequence of the repository's current manifests and pinned pnpm. Add an executable lock assertion that fails if any vulnerable js-yaml@4.3.0 occurrence remains and confirms 4.3.1 is the effective resolution for the ESLint path. Do not hand-edit integrity hashes merely to shrink the diff. Current exact-head repository workflows are still queued and there is no submitted independent review.

[seonghobae]

Lock-delta review resolved on exact head c3cf4efc478a264a0a010df82d1ea90b48776610 without source changes. Pinned pnpm 11.5.3 reproduced lock hash 018f0382c815ea7a35899e64ddb6c3645399fcb6 byte-for-byte; the narrower update command was rejected because it changed additional unrelated Vite/WASM closure entries. The executable lock security contract passes (2 tests), and git diff --check is clean. PR remains Draft pending exact-head hosted Checks and independent review.

[seonghobae]

The Naruon CI owner integration verifies frozen pnpm11.5.3 install, 439 frontend tests and ESLint; installed ESLint resolves js-yaml4.3.1. Actual pnpm exec tsc --noEmit then reproduces TS1503 at frontend/src/dependency-lock.security.test.ts:30: named capturing groups require ES2018 or later, above this project's target. Taking a narrowly scoped fix on this existing dependency owner: use equivalent numbered capture in the test, preserve workspace override/lock/integrity and TS target, rerun tests/typecheck, guarded ordinary push, then normal child integration into #1562. No other file/lock writer or new PR. Existing c3cf4ef remains the pre-fix receipt; it is not complete typecheck evidence.

[seonghobae]

The standalone current dependency head 3f568412da61f12ba36c71765bf915acc8abb85d now passes frozen pnpm 11.5.3 install, all 52 frontend files / 439 tests, lint, typecheck and diff validation. Its own GitHub merge ref beaaf7415a9ae57caaff9c53d0cb612924da7ec0 (tree 21bb392248542c8b8c7b498dd4f2af292d8c1d51) passes the refreshed local HIGH/CRITICAL fixable Trivy vulnerability/misconfiguration scan including development dependencies. No source/prerequisite findings or unresolved review threads are identified in this bounded three-file slice.

The earlier body instruction to keep Draft until approval is circular with the protected central workflow: .github@43024633eba9d96b0456970391360da5a171fbda/.github/workflows/opencode-review.yml:360-362 expressly declines review dispatch for a live Draft. I am marking this completed slice Ready for independent review, not merge-ready. Required hosted checks, qualifying exact-head independent approval, last-push requirements and protected merge remain mandatory. No empty commit, manual status, review dismissal or bypass is involved; only review admission changes.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.