[AlexSaveliev1]

What/Why/How?

Resolves two Vanta findings, both the same CVE on different js-yaml major lines:

• npm-js-yaml >= 4.0.0, < 4.3.2 / CVE-2026-84375
• npm-js-yaml >= 3.0.0, < 3.15.2 / CVE-2026-84375

Instance	Before	After	Scope
js-yaml	4.3.1	4.3.2	production
eslint/node_modules/js-yaml	3.15.1	3.15.2	dev
@eslint/eslintrc/node_modules/js-yaml	3.15.1	3.15.2	dev
@istanbuljs/load-nyc-config/node_modules/js-yaml	3.15.1	3.15.2	dev

Why @redocly/openapi-core moves too (1.34.19 → 1.34.20). It pins every dependency to an exact version, including "js-yaml": "4.3.1". An exact pin can't be satisfied by bumping the root js-yaml — npm just nests a second, still-vulnerable copy in the production tree. 1.34.20 is the first release repinning it to 4.3.2, so updating openapi-core is the only way to reach that copy short of an overrides entry.

The three 3.x copies are dev-only and declare ^3.13.1, so they picked up 3.15.2 from the lockfile refresh alone.

Declared ranges are raised above the vulnerable range too:

- "js-yaml": "^4.1.0"                      + "js-yaml": "^4.3.2"
- "@redocly/openapi-core": "^1.34.15"      + "@redocly/openapi-core": "^1.34.20"

Both old ranges already resolved to the patched versions, so this doesn't change the installed tree — it's a regression floor, so a future resolution or a revert can't silently land back on js-yaml 4.3.1 via openapi-core 1.34.19.

Reproduce with:

npm install --package-lock-only

Reference

Vanta: npm-js-yaml >= 3.0.0, < 3.15.2 and npm-js-yaml >= 4.0.0, < 4.3.2, both CVE-2026-84375.
Prior art: #2832 (chore(deps): resolve js-yaml, fast-uri and brace-expansion CVEs).

Tests

No new tests — dependency-only change, existing suite is the regression check.

• npm ci from the regenerated lock: clean, 1562 packages
• npm ls js-yaml --all: every instance 4.3.2 or 3.15.2, no vulnerable copy remaining
• npx jest: 276 passed, 27 suites, 52 snapshots
• npm run ts-check: clean
• npm run license-check: clean, no new license classes

Check yourself

• Code is linted
• Tested
• All new/updated code is covered with tests

---

Out of scope: npm audit still reports a separate js-yaml advisory reached via argparse (range 3.2.7 - 3.15.2), dev-only through eslint 7. Its only fix is a major bump to eslint@10 — worth a separate PR.

🤖 Generated with Claude Code