Bump js-yaml and promptfoo in /test/ai-development

[dependabot]

Bumps js-yaml to 5.4.1 and updates ancestor dependency promptfoo. These dependencies need to be updated together.

Updates js-yaml from 5.3.0 to 5.4.1

Changelog

Sourced from js-yaml's changelog.

[5.4.1] - 2026-08-26

Changed

• Hard-limit merge sequence size to 100.

Security

• Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

• Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

• [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
• [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
• Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

• Accept a byte order mark at the start of each document in a stream, #791.
• Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
• Preserve empty scalar items when converting block sequences to flow style.
• Do not apply the 1024-character simple-key limit to flow mapping keys.
• Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
• Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

Commits

• e5a3ba0 5.4.1 released
• e54dea3 Hard-limit merge sequence size to 100
• dfd3a29 Cleanup 6a8e05f, #797
• 6a8e05f fix: count empty merge sources against maxTotalMergeKeys (#797)
• 6b4ff5e 5.4.0 released
• 3b3625e Update changelog
• 4f25a74 Fix file name
• 3bd003b Expose new scalar styling API
• fbb3e9d Remove regex lookbehind for ES2015 compatibility
• d43c185 Fix flowSkipColonSpace by forcing quoteFlowKeys
• Additional commits viewable in compare view

Updates promptfoo from 0.122.1 to 0.123.1

Release notes

Sourced from promptfoo's releases.

0.123.1

0.123.1 (2026-09-18)

Features

• bedrock: refresh auth across HTTP adapters (#10123) (9d3f063)
• providers: add Gemini 3.8 and Vertex Live (#10956) (1417f22)
• providers: add GPT-Live voice sessions (#10891) (316a334)
• providers: add OpenAI Agents API (#10892) (ad3bee3)
• providers: add portable HTTP config schemas (#10968) (fcd0604)
• providers: add portable MCP config schemas (#10965) (f5ccb3c)
• providers: support Ollama 0.34 features and refresh model docs (#10964) (ac01a4f)
• providers: surface Ollama thinking output and finish reason (#10954) (27d4c22)
• providers: update Gemini tools and media support (#10172) (627bdd0)

Bug Fixes

• assertions: bound embedded tool call parsing (#10877) (78202a3)
• assertions: bound tool-call parser state (#10887) (15290b4)
• assertions: default RAG assertion thresholds to 0.5 (#10202) (4831b60), closes #9910 #9848
• assertions: invert score along with pass for search-rubric (#10103) (26e8f2f)
• assertions: never invert grader failures on not-classifier and not-search-rubric (#10904) (e049702)
• assertions: reject malformed webhook results (#10955) (fc57736)
• assertions: reject non-string search rubrics (#10934) (7bbb79e)
• auth: harden custom header requests (#10524) (5325084)
• cli: handle large values during result export (#10884) (be798f4)
• cli: preserve in-memory results for extensions (#10885) (60483d9)
• code-scan: extractValidLineRanges off-by-one on trailing newline (#10107) (2cbabdb)
• config: preserve discovery in paths containing quotes (#10549) (d9b3927)
• db: preserve shared blobs after persistence errors (#10897) (3b353fb)
• deps: update dependency @​anthropic-ai/sdk to v0.123.0 (#10901) (14f7c06)
• deps: update dependency @​anthropic-ai/sdk to v0.124.0 (#10940) (29a15d1)
• deps: update engine.io to v6.6.10 (#10915) (e54a968)
• deps: update opentelemetry (#10886) (280bc5e)
• deps: update type definitions (#10924) (01c6397)
• drain database writes and preserve provider options (#10911) (32bfa9e)
• eval: keep concurrent derived metrics consistent (#10873) (2a3a3bd)
• eval: preserve audio grading results and order (#10822) (395d21e)
• eval: preserve cloud UUID config semantics (#7732) (8544fed)
• fetch: decode URL credentials and match Authorization case-insensitively (#10909) (b8aa6ff)
• fetch: treat credit_balance_exhausted as a hard quota error (#10881) (7f21bb2)
• honor SDK options and load AVIF/TIFF images (#10902) (15bba21)
• integrations: honor --env-file and config env for Helicone key and Langfuse base URL (#10942) (8bd9f37)
• integrations: read Langfuse env at fetch time (#10937) (033080c)
• integrations: share Langfuse prompt fetches and surface real SDK load errors (#10943) (379ecd0)
• matchers: tag context-faithfulness grader failures (#9907) (77bc3ba)
• matchers: tag RAG grader failures so inverse assertions cannot pass (#10494) (b3d21d2)
• mcp: accept fine-tuned model identifiers (#10847) (9442129)

... (truncated)

Changelog

Sourced from promptfoo's changelog.

0.123.1 (2026-09-18)

Features

• bedrock: refresh auth across HTTP adapters (#10123) (9d3f063)
• providers: add Gemini 3.8 and Vertex Live (#10956) (1417f22)
• providers: add GPT-Live voice sessions (#10891) (316a334)
• providers: add OpenAI Agents API (#10892) (ad3bee3)
• providers: add portable HTTP config schemas (#10968) (fcd0604)
• providers: add portable MCP config schemas (#10965) (f5ccb3c)
• providers: support Ollama 0.34 features and refresh model docs (#10964) (ac01a4f)
• providers: surface Ollama thinking output and finish reason (#10954) (27d4c22)
• providers: update Gemini tools and media support (#10172) (627bdd0)

Bug Fixes

• assertions: bound embedded tool call parsing (#10877) (78202a3)
• assertions: bound tool-call parser state (#10887) (15290b4)
• assertions: default RAG assertion thresholds to 0.5 (#10202) (4831b60), closes #9910 #9848
• assertions: invert score along with pass for search-rubric (#10103) (26e8f2f)
• assertions: never invert grader failures on not-classifier and not-search-rubric (#10904) (e049702)
• assertions: reject malformed webhook results (#10955) (fc57736)
• assertions: reject non-string search rubrics (#10934) (7bbb79e)
• auth: harden custom header requests (#10524) (5325084)
• cli: handle large values during result export (#10884) (be798f4)
• cli: preserve in-memory results for extensions (#10885) (60483d9)
• code-scan: extractValidLineRanges off-by-one on trailing newline (#10107) (2cbabdb)
• config: preserve discovery in paths containing quotes (#10549) (d9b3927)
• db: preserve shared blobs after persistence errors (#10897) (3b353fb)
• deps: update dependency @​anthropic-ai/sdk to v0.123.0 (#10901) (14f7c06)
• deps: update dependency @​anthropic-ai/sdk to v0.124.0 (#10940) (29a15d1)
• deps: update engine.io to v6.6.10 (#10915) (e54a968)
• deps: update opentelemetry (#10886) (280bc5e)
• deps: update type definitions (#10924) (01c6397)
• drain database writes and preserve provider options (#10911) (32bfa9e)
• eval: keep concurrent derived metrics consistent (#10873) (2a3a3bd)
• eval: preserve audio grading results and order (#10822) (395d21e)
• eval: preserve cloud UUID config semantics (#7732) (8544fed)
• fetch: decode URL credentials and match Authorization case-insensitively (#10909) (b8aa6ff)
• fetch: treat credit_balance_exhausted as a hard quota error (#10881) (7f21bb2)
• honor SDK options and load AVIF/TIFF images (#10902) (15bba21)
• integrations: honor --env-file and config env for Helicone key and Langfuse base URL (#10942) (8bd9f37)
• integrations: read Langfuse env at fetch time (#10937) (033080c)
• integrations: share Langfuse prompt fetches and surface real SDK load errors (#10943) (379ecd0)
• matchers: tag context-faithfulness grader failures (#9907) (77bc3ba)
• matchers: tag RAG grader failures so inverse assertions cannot pass (#10494) (b3d21d2)
• mcp: accept fine-tuned model identifiers (#10847) (9442129)
• opencode: capture skill calls from full session history (#10011) (290973d)
• prompts: CSV rows collapse to duplicate labels/IDs when basePrompt.label is set (#10102) (25963c3)
• providers: align ElevenLabs requests and audio inputs (#10736) (de12341)

... (truncated)

Commits

• 34f74d3 chore(main): release 0.123.1 (#10879)
• 9d3f063 feat(bedrock): refresh auth across HTTP adapters (#10123)
• 5325084 fix(auth): harden custom header requests (#10524)
• f385d96 fix(providers): isolate Agents endpoint credentials (#10951)
• ba0eeb4 fix(providers): preserve patterned OpenCode skill history (#10971)
• 288e26c chore(deps): update dependency oxc-parser to ^0.149.0 (#10975)
• fc57736 fix(assertions): reject malformed webhook results (#10955)
• 52ce503 chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#...
• 1417f22 feat(providers): add Gemini 3.8 and Vertex Live (#10956)
• 08e91da fix(redteam): preserve strategy grading context (#10969)
• Additional commits viewable in compare view

[github-actions]

🤖 PR meta 🤖

🏷️ Labels

This pull request needs exactly one label indicating its type, and has 0.

• Required: any label starting with [Type].
• Found: none.

Read more about Type labels in Gutenberg. If you cannot add labels yourself, a reviewer can do it for you.

📦 Bundle size

Size Change: 0 B

Total Size: 8.24 MB

_{f69f807 Run}

⚡ Performance

Show the results

Client side metrics exclude the server response time.

front-end-block-theme

Metric	8b2ffb9	trunk	% Change
timeToFirstByte	57.05 ms +12.88% -1.93%	58.75 ms +11.66% -3.74%	-2.89%
largestContentfulPaint	98 ms +2.04% -6.12%	100 ms +8% -8%	-2%
lcpMinusTtfb	35.6 ms +9.27% -6.04%	36.1 ms +19.25% -4.85%	-1.39%
wpBeforeTemplate	28.4 ms +15.32% -2.04%	28.68 ms +20.26% -2.09%	-0.98%
wpTemplate	24.95 ms +1.96% -3.45%	24.71 ms +6.56% -2.31%	0.97%
wpTotal	53.39 ms +12.31% -1.85%	55.01 ms +10.87% -4.07%	-2.94%
wpMemoryUsage	7.62 MB +0% -0%	7.58 MB +0% -0%	0.51%
wpDbQueries	17 +0% -0%	17 +0% -0%	0%

front-end-classic-theme

Metric	8b2ffb9	trunk	% Change
timeToFirstByte	48.55 ms +5.77% -2.37%	47.9 ms +10.44% -1.36%	1.36%
largestContentfulPaint	104 ms +3.85% -0%	104 ms +3.85% -3.85%	0%
lcpMinusTtfb	56 ms +1.16% -1.43%	55.2 ms +2.36% -3.71%	1.45%
wpBeforeTemplate	26.98 ms +6.97% -2.37%	26.68 ms +7.12% -1.27%	1.12%
wpTemplate	18.25 ms +4.44% -2.19%	18.58 ms +3.88% -3.23%	-1.78%
wpTotal	45.45 ms +6.01% -2.29%	44.99 ms +10.09% -1.53%	1.02%
wpMemoryUsage	6.24 MB +0% -0%	6.20 MB +0% -0%	0.58%
wpDbQueries	14 +0% -0%	14 +0% -0%	0%

media-processing

Metric	8b2ffb9	trunk	% Change
mediaProcessingJpeg	402.31 ms +1.31% -0.94%	398.79 ms +2.06% -0.75%	0.88%
mediaProcessingAvif	6057.67 ms +0.14% -0.19%	6071.74 ms +0.27% -0.12%	-0.23%
mediaProcessingJpegToAvif	4175.72 ms +0.24% -0.11%	4183.24 ms +0.17% -0.29%	-0.18%

media-upload

Metric	8b2ffb9	trunk	% Change
jpegUploadProcessing	1455.52 ms +32.54% -3.09%	1439.43 ms +2.79% -1.2%	1.12%
pngUploadProcessing	199.16 ms +9.98% -14.4%	216.79 ms +13.27% -13.55%	-8.13%
largeJpegUploadProcessing	1411.25 ms +0.63% -0.65%	1424.96 ms +0.22% -0.3%	-0.96%
multipleImageUploadProcessing	1583.21 ms +0.74% -1.37%	2093.99 ms +0.43% -22.98%	-24.39%

post-editor

Metric	8b2ffb9	trunk	% Change
serverResponse	337.07 ms +6.35% -2.6%	351.41 ms +2.84% -7.27%	-4.08%
firstPaint	194.05 ms +25.73% -22.25%	152.5 ms +23.42% -8.15%	27.25%
domContentLoaded	829.29 ms +1.58% -3.83%	828.06 ms +1.15% -2.52%	0.15%
loaded	830.16 ms +1.57% -3.81%	828.9 ms +1.15% -2.51%	0.15%
firstContentfulPaint	354.02 ms +1.19% -3.96%	360.91 ms +0.66% -5.74%	-1.91%
firstBlock	2428.79 ms +1.17% -2.84%	2337.21 ms +1.62% -0.66%	3.92%
type	14.8 ms +5.47% -2.36%	14.45 ms +11.42% -2.7%	2.42%
typeWithoutInspector	15.36 ms +2.34% -8.59%	13.73 ms +9.83% -4.3%	11.87%
typeWithTopToolbar	18.76 ms +6.98% -2.56%	18.85 ms +4.62% -3.93%	-0.48%
typeContainer	1.05 ms +19.05% -39.05%	1.02 ms +5.88% -39.22%	2.94%
focus	9.76 ms +9.22% -9.73%	8.78 ms +16.51% -6.72%	11.16%
firstFocus	20.42 ms +0% -0%	21.26 ms +0% -0%	-3.95%
selectAll	1099.08 ms +2.61% -0.99%	993.03 ms +4.51% -1.02%	10.68%
listViewOpen	46.24 ms +11.22% -3.24%	47.45 ms +2.89% -6.45%	-2.55%
inserterOpen	19.11 ms +18% -8.22%	17.19 ms +23.85% -4.6%	11.17%
inserterHover	1.68 ms +10.71% -14.88%	1.51 ms +8.61% -9.93%	11.26%
inserterSearch	7.04 ms +4.97% -4.97%	6.39 ms +6.57% -5.79%	10.17%
loadPatterns	516.51 ms +5.01% -2.23%	498.73 ms +6.36% -1.96%	3.57%
wpTotal	328.52 ms +6.19% -2.63%	342.82 ms +2.86% -7.48%	-4.17%
wpMemoryUsage	13.16 MB +0% -0%	13.13 MB +0% -0%	0.25%
wpDbQueries	54 +0% -0%	54 +0% -0%	0%

site-editor

Metric	8b2ffb9	trunk	% Change
serverResponse	240.21 ms +3.07% -1.5%	246.29 ms +1.1% -8.77%	-2.47%
firstPaint	163.01 ms +36.61% -20.72%	151.61 ms +19.6% -10.61%	7.52%
domContentLoaded	672.74 ms +1.55% -1%	672.11 ms +2.56% -3.29%	0.09%
loaded	673.57 ms +1.55% -1%	672.97 ms +2.57% -3.29%	0.09%
firstContentfulPaint	289.74 ms +4.07% -2.37%	289.04 ms +0.17% -2.06%	0.24%
firstBlock	2392.99 ms +2.34% -1.39%	2389.48 ms +0.65% -3.76%	0.15%
type	12.96 ms +6.1% -4.01%	12.93 ms +1.16% -4.95%	0.23%
navigate	79.03 ms +11.46% -8.98%	76.06 ms +9.91% -3.1%	3.9%
loadPatterns	835.29 ms +5.1% -5.24%	866.72 ms +2.66% -5.98%	-3.63%
loadPages	977.79 ms +2.72% -2.66%	1056.67 ms +1.11% -1.34%	-7.46%
wpTotal	234.01 ms +3.12% -1.65%	239.94 ms +1.16% -8.96%	-2.47%
wpMemoryUsage	12.14 MB +0% -0%	12.11 MB +0% -0%	0.3%
wpDbQueries	44 +0% -0%	44 +0% -0%	0%

_{f69f807 Run}

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: talldan <talldanwp@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.