Bump js-yaml from 3.14.2 to 3.15.0 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: js-yaml.

Updates js-yaml from 3.14.2 to 3.15.0

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

• Added docs/safety.md with notes about processing untrusted YAML.
• Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
• Added a loader option limiting merge sequence length. Not a problem after merge fix, but an additional restriction for safety.
• Added sourcemaps to dist/ builds.

Changed

• Stop resolving numbers with underscores as numeric scalars, #627.
• Switched dev toolchains to Vite / neostandard.
• Updated demo.
• Reorganized tests.
• dist/ files are no longer kept in the repository.

Fixed

• Fix parsing of properties on the first implicit block mapping key, #62.
• Fix trailing whitespace handling when folding flow scalar lines, #307.
• Reject top-level block scalars without content indentation, #280.
• Ensure numbers survive round-trip, #737.
• Fix test coverage for issue #221.
• Fix flow scalar trailing whitespace folding, #307.
• Fix digits in YAML named tag handles.

Security

• Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

Commits

• 590dbab 4.2.0 released
• f944dc5 Add package.json funding field
• f692719 Changelog update
• 9971a06 Fix digits in YAML named tag handles
• 464a5b8 Fix flow scalar trailing whitespace folding, close #307
• 1fda4f7 Tests for #567, #565
• 031ad07 Stop resolving numbers with underscores as numeric scalars, #627
• e46d223 CI config update
• 9023fee Add lockfile
• 990e6f4 Docs update
• Additional commits viewable in compare view

[francinelucca]

@copilot fix CI

[Copilot]

@copilot fix CI

Fixed in commit Fix CI: upgrade eslint-plugin-github to 6.1.1, migrate to flat config.

Root cause: eslint-plugin-github@4.10.2 required eslint@"^8.0.1" as a peer dependency, but this PR set eslint@"^10.7.0", causing npm install to fail with ERESOLVE.

Changes made:

• Upgraded eslint-plugin-github from 4.10.2 → 6.1.1 (supports eslint@^8 || ^9 || ^10)
• Migrated ESLint config from .eslintrc.json (legacy format, unsupported in eslint@10) to eslint.config.mjs (flat config)
• Removed .eslintignore (replaced with ignores in the flat config)
• Added "types": [] to tsconfig.json to prevent the newly-added @types/esrecurse package (which uses TypeScript 4.5+ syntax) from failing compilation with TypeScript 4.2.4

[francinelucca]

@dependabot recreate

[francinelucca]

@copilot bump js-yaml only, do not update eslint

[Copilot]

@copilot bump js-yaml only, do not update eslint

Done. Reverted eslint back to ^7.26.0 and eslint-plugin-github back to 4.1.5 in commit Revert eslint and eslint-plugin-github to original versions; keep js-yaml 4.2.0 bump. The PR now only contains the js-yaml bump to 4.2.0.

[francinelucca]

@copilot fix CI

[Copilot]

@copilot fix CI

Fixed in commit Fix CI: restore hoisted eslint-plugin-import by using main lockfile + js-yaml 3.15.0 bump.

Root cause: the previously regenerated package-lock.json caused npm to nest eslint-plugin-import under node_modules/eslint-plugin-github/node_modules/ instead of hoisting it to the top level. ESLint 7 requires plugins to be resolvable from the project root, so it couldn't find the plugin.

Fix: restored package-lock.json from main (which keeps eslint-plugin-import hoisted) and applied only the two js-yaml 3.14.2 → 3.15.0 version bumps on top. The diff vs main is now exclusively those two lockfile entries.