chore(security): patch 1 Dependabot alert

[PMerlet]

👋 First-level support: see Handling automated security PRs for how to triage and merge this PR.

Summary

1 fixed, 0 ignored, 0 deferred, 0 security pins added, 0 security pins removed, 0 could-not-auto-fix. | label: 🔒 security applied

Fixed

Done	Alert	Gem	Ecosystem	From → To	Severity	What was bumped
- [x]	#107	js-yaml	npm	4.3.0 → 4.3.1	high	Transitive under semantic-release#cosmiconfig and @commitlint/cli#…#cosmiconfig. Added a root resolutions entry "js-yaml": "^4.3.1" in package.json (bounded to the parents-compatible 4.x major); regenerated yarn.lock.

Ignored

None.

Deferred

None.

Security pins added

None.

Security pins removed

None.

Could not auto-fix

None.

Risks

• js-yaml 4.3.0 → 4.3.1: patch release fixing CVE-2026-59870 (quadratic CPU consumption in !!omap resolution). No behavior change beyond the patched vulnerability per the upstream changelog — parsing/dumping API surface is unchanged.

Manual testing

Covered by CI.

Validation

✅ CI green (Actions + commit statuses; app-based checks not monitored)

[qltysh]

Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.