From 7bc2dee7fc7c0a8e2c761860d2af8f772220b33c Mon Sep 17 00:00:00 2001
From: Aaron Sachs <898627+asachs01@users.noreply.github.com>
Date: Tue, 15 Sep 2026 12:30:50 -0400
Subject: [PATCH] fix(deps): resolve js-yaml CVE-2026-84375

Force js-yaml >= 4.3.2 via a scoped npm override on cosmiconfig
(the transitive parent(s) of js-yaml), clearing the HIGH advisory
GHSA-2883-xcg3-v3hh (CVE-2026-84375, vulnerable range >= 4.0.0 < 4.3.2).
js-yaml is a dev-only transitive dependency.

npm audit: 0 vulnerabilities. Build, lint, typecheck, and tests all pass.
---
 package-lock.json | 6 +++---
 package.json      | 5 +++++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 2aa41a9..16f9d13 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4696,9 +4696,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "dev": true,
       "funding": [
         {
diff --git a/package.json b/package.json
index fd42718..a76f621 100644
--- a/package.json
+++ b/package.json
@@ -75,5 +75,10 @@
   "dependencies": {
     "graphql": "^16.14.2",
     "graphql-request": "^7.1.2"
+  },
+  "overrides": {
+    "cosmiconfig": {
+      "js-yaml": "^4.3.2"
+    }
   }
 }