From f1eae89ff08c50fe95cc6fa2b8adef3ecd6d935e Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 12 Jun 2026 05:53:12 +0000
Subject: [PATCH] chore(deps): update dependency js-yaml to v4.2.0 (#515)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [js-yaml](https://redirect.github.com/nodeca/js-yaml) | [`4.1.1` →
`4.2.0`](https://renovatebot.com/diffs/npm/js-yaml/4.1.1/4.2.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/js-yaml/4.2.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/js-yaml/4.1.1/4.2.0?slim=true)
|

---

### Release Notes

<details>
<summary>nodeca/js-yaml (js-yaml)</summary>

###
[`v4.2.0`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#420---2026-06-01)

[Compare
Source](https://redirect.github.com/nodeca/js-yaml/compare/4.1.1...590dbabadd172b099c07654fab2eabec8c7a07b9)

##### Added

- Added `docs/safety.md` with notes about processing untrusted YAML.
- Added `maxDepth` (100) loader option. Not a problem, but gives a
better
  exception instead of RangeError on stack overflow.
- Added `maxMergeSeqLength` (20) loader option. Not a problem after
`merge` fix,
  but an additional restriction for safety.
- Added sourcemaps to `dist/` builds.

##### Changed

- Stop resolving numbers with underscores as numeric scalars,
[#&#8203;627](https://redirect.github.com/nodeca/js-yaml/issues/627).
- Switched dev toolchains to Vite / neostandard.
- Updated demo.
- Reorganized tests.
- `dist/` files are no longer kept in the repository.

##### Fixed

- Fix parsing of properties on the first implicit block mapping key,
[#&#8203;62](https://redirect.github.com/nodeca/js-yaml/issues/62).
- Fix trailing whitespace handling when folding flow scalar lines,
[#&#8203;307](https://redirect.github.com/nodeca/js-yaml/issues/307).
- Reject top-level block scalars without content indentation,
[#&#8203;280](https://redirect.github.com/nodeca/js-yaml/issues/280).
- Ensure numbers survive round-trip,
[#&#8203;737](https://redirect.github.com/nodeca/js-yaml/issues/737).
- Fix test coverage for issue
[#&#8203;221](https://redirect.github.com/nodeca/js-yaml/issues/221).
- Fix flow scalar trailing whitespace folding,
[#&#8203;307](https://redirect.github.com/nodeca/js-yaml/issues/307).
- Fix digits in YAML named tag handles.

##### Security

- Fix potential DoS via quadratic complexity in merge - deduplicate
repeated
  elements (makes sense for malformed files > 10K).

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/Chicago)

- Branch creation
  - Only on Friday (`* * * * 5`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/jdx/mise-action).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 package-lock.json | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 5ffbddf..dd828a5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5251,10 +5251,20 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
+      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
       "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
       "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1"