chore(deps): bump js-yaml 4.3.2 and baseline-browser-mapping 2.11.22

[VatsalSy]

Description

Dependabot alert #71 is open for js-yaml 4.3.1 (GHSA-2883-xcg3-v3hh / CVE-2026-84375, high). There is no Dependabot PR for it. The existing npm override still pinned 4.3.1.

Dependabot #43 also bumped transitive baseline-browser-mapping 2.10.38 → 2.11.22, then conflicted after #42 merged browserslist and left the lockfile on 2.11.21. Dependabot later closed #43 as "up-to-date"; this PR reapplies 2.11.22 onto current main so that bump is not lost.

Type of Change

• Bug fix
• New feature
• Content update (Team/Publication)
• Documentation update
• Other (please describe) — dependency security hygiene

Changes Made

• package.json overrides: js-yaml 4.3.1 → 4.3.2 (alert #71)
• package-lock.json: hoist js-yaml@4.3.2; bump baseline-browser-mapping 2.11.21 → 2.11.22 (reapply Bump baseline-browser-mapping from 2.10.38 to 2.11.22 #43)

Major-version judgment

Not required. Both are patches on already-used 4.x / 2.11.x lines. markdownlint-cli2 stays on 0.20.0.

Testing Done

• npm test (11/11 passed)
• npm run lint (js/css/md clean)
• Isolated npm ci from the js-yaml lockfile: every js-yaml edge is 4.3.2
• Registry integrity for js-yaml@4.3.2 and baseline-browser-mapping@2.11.22 match the lockfile
• Tested locally using bundle exec jekyll serve (Ruby/Bundler not installed in this agent image)
• Checked all links and references
• Verified content formatting
• Cross-browser testing (if UI changes)

Related Issues

Addresses Dependabot alert #71. Supersedes Dependabot #43. #42 is already merged and is not reopened.

Checklist

• Code follows the project's style guidelines
• Changes have been tested locally (npm test/lint + isolated npm ci)
• All links are valid and working
• Images are optimized and properly sized
• Content is properly formatted
• Documentation has been updated (if needed)

Additional Notes

Left nanoid (high) and colord (moderate) unfixed: they are not alert #71 and have no open Dependabot PRs. Deploy is expected to skip on PR; Actions is the merge gate. Do not squash.

  

Summary by CodeRabbit

• Chores
  • Updated the YAML parsing component to version 4.3.2.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: e9de878a-06e3-42bc-89d7-32112401bb39

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 2d507ebf-b3b1-4318-9c4a-823e418a96a9

📥 Commits

Reviewing files that changed from the base of the PR and between a04da5f and 5ef9598.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: Cursor Bugbot

🔇 Additional comments (1)

package.json (1)

42-42: LGTM!

---

📝 Walkthrough

Walkthrough

The package configuration updates the js-yaml dependency override from 4.3.1 to 4.3.2.

Changes

Dependency override

Layer / File(s)	Summary
Update js-yaml override package.json	The override now requires js-yaml version 4.3.2 instead of 4.3.1.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Suggested reviewers: comphy-bot

Merge Risk: ⚪ Minimal · up to 5ef95

The dependency override and lockfile are reported as aligned, with no remaining merge-blocking concerns.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the dependency update from js-yaml 4.3.1 to 4.3.2 and its Dependabot purpose.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch rayleigh-cloud/js-yaml-4.3.2-4c70

---

_{Comment @coderabbitai help to get the list of available commands.}