From 43ba1a91fae5b7fa5b293ddabe5b71e4c7cf33d6 Mon Sep 17 00:00:00 2001
From: Armando Anaya <armando@robomous.ai>
Date: Wed, 12 Aug 2026 20:08:45 -0700
Subject: [PATCH] fix(deps): pin js-yaml past GHSA-5p4m-2wfm-xmqj

osv-scanner reported js-yaml 4.3.0 (GHSA-5p4m-2wfm-xmqj, CVSS 7.5) in the
root lockfile. It arrives through openapi-typescript ->
@redocly/openapi-core, which depends on js-yaml at an *exact* 4.3.0, so no
`pnpm update` can move it -- a version-scoped override is the only lever.

Scoped to `js-yaml@4.3.0` rather than a bare `js-yaml` override so it
expires on its own: once @redocly widens its pin, the entry stops matching
and nothing is silently held back. docs-site's lockfile already resolves
4.3.1 and is untouched.

`pnpm generate:client:check` is byte-identical, so the one consumer of the
upgraded parser produces the same output.
---
 package.json   |  5 ++++-
 pnpm-lock.yaml | 11 +++++++----
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index d530d05d..074e7c87 100644
--- a/package.json
+++ b/package.json
@@ -18,7 +18,10 @@
   "pnpm": {
     "onlyBuiltDependencies": [
       "esbuild"
-    ]
+    ],
+    "overrides": {
+      "js-yaml@4.3.0": "4.3.1"
+    }
   },
   "devDependencies": {
     "openapi-typescript": "7.13.0"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 2610c4ad..ade346e5 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -4,6 +4,9 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
+overrides:
+  js-yaml@4.3.0: 4.3.1
+
 importers:
 
   .:
@@ -1666,8 +1669,8 @@ packages:
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
-  js-yaml@4.3.0:
-    resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==}
+  js-yaml@4.3.1:
+    resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==}
     hasBin: true
 
   jsdom@30.0.1:
@@ -3057,7 +3060,7 @@ snapshots:
       colorette: 1.4.0
       https-proxy-agent: 7.0.6(supports-color@10.2.2)
       js-levenshtein: 1.1.6
-      js-yaml: 4.3.0
+      js-yaml: 4.3.1
       minimatch: 5.1.9
       pluralize: 8.0.0
       yaml-ast-parser: 0.0.43
@@ -3710,7 +3713,7 @@ snapshots:
 
   js-tokens@4.0.0: {}
 
-  js-yaml@4.3.0:
+  js-yaml@4.3.1:
     dependencies:
       argparse: 2.0.1