chore: force patched js-yaml for CVE-2026-59870

[allxsmith]

What

pnpm audit --audit-level=high started failing on every branch (including docs-only PR #478) when GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 was published: js-yaml quadratic CPU consumption resolving !!omap, affecting both majors in our tree.

• js-yaml 3.x (needs ≥3.15.1) — rides the jest coverage chain (babel-plugin-istanbul > @istanbuljs/load-nyc-config)
• js-yaml 4.x (needs ≥4.3.1) — rides cosmiconfig (commitlint, semantic-release) and the Docusaurus frontmatter pipeline (~100 paths)

Every parent range already admits the patched releases; the lockfile just predates them (both published 2026-07-31, so already older than the 3-day cooldown — no minimumReleaseAgeExclude entry needed). Following the established overrides pattern in pnpm-workspace.yaml, this adds per-major scoped forces with the advisory documented and a prune condition:

'js-yaml@3': '>=3.15.1 <4'
'js-yaml@4': '>=4.3.1 <5'

Also drops the undici@7.29.0 cooldown-exclude entry, exactly as its own comment schedules ("drop this entry once 7.29.0 is older than the cooldown (after 2026-08-06)"); the undici@7 override itself stays.

Verification

• pnpm install re-resolves cleanly; the lockfile now carries exactly js-yaml@3.15.1 and js-yaml@4.3.1 (only additions, no other resolution changes).
• pnpm audit --audit-level=high exits 0 (remaining advisories: 1 low, 7 moderate — below the gate).
• Full pnpm all gate green: build, typecheck, tests + coverage, bundle stats, lint, format check, storybook build.

Dev/build tooling only; js-yaml is not a dependency of the published packages, so this is non-releasing (chore). Unblocks #478, which I'll refresh against main once this lands.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Warning

Review limit reached

@allxsmith, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 43 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 18b9f23d-200c-4e37-953a-cbd799e39250

📥 Commits

Reviewing files that changed from the base of the PR and between 54b78cd and 7683c52.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[bestaxbot]

AI triage — issues this PR may resolve

• [Refactor] The audit gate + 3-day cooldown structurally guarantee red CI when a patch is fresher than 72h #391 — [Refactor] The audit gate + 3-day cooldown structurally guarantee red CI when a patch is fresher than 72h: this PR is a concrete instance of the exact friction [Refactor] The audit gate + 3-day cooldown structurally guarantee red CI when a patch is fresher than 72h #391 describes — a fresh high-severity patch (js-yaml, CVE-2026-59870) forced in via override/cooldown-exclude to unblock pnpm audit. It doesn't implement [Refactor] The audit gate + 3-day cooldown structurally guarantee red CI when a patch is fresher than 72h #391's structural fix, but directly relates to it.

If this PR resolves one of these, add the line below to the PR description
so the issue closes on merge:

Fixes #391

[github-actions]

Preview Deployment

Preview URL: https://b5b66535.bestax.pages.dev

[bestax-release-bot]

🎉 This PR is included in version 5.8.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[bestax-release-bot]

🎉 This PR is included in version 4.0.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[bestax-release-bot]

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[bestax-release-bot]

🎉 This PR is included in version 2.0.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀