fix(security): update js-yaml and ws

[tavva]

Summary

Updates only transitive js-yaml and ws lockfile entries to patched releases:

• js-yaml 3.14.2 → 3.15.1 in the v3 dependency paths
• js-yaml 4.1.1 → 4.3.1 in the v4 dependency path
• ws 8.18.3 → 8.21.3

This resolves the repository's open js-yaml and ws Dependabot alerts without changing direct dependency declarations.

Advisory details

• js-yaml: GHSA-52cp-r559-cp3m / CVE-2026-59869 and GHSA-5p4m-2wfm-xmqj, plus the superseded GHSA-h67p-54hq-rp68 / CVE-2026-53550 alerts (Dependabot fix: update vulnerable dependencies #49, Bump uuid from 13.0.0 to 14.0.0 in the npm_and_yarn group across 1 directory #50, Add projects next actions to general actions #52, User preferences not sticking #53, fix(security): patch brace-expansion CPU denial of service #61, #64). Patched at 3.15.1 and 4.3.1 for the currently affected dependency lines.
• ws: GHSA-96hv-2xvq-fx4p / CVE-2026-48779 (Dependabot Make wikilinks and tags clickable in focus view #46). Patched at 8.21.0; this PR takes the current 8.21.3 patch release.

Changelog/release-note review

• js-yaml 4.2.0 adds parser safety limits; 4.3.0 replaces the merge limit with maxTotalMergeKeys; 4.3.1 removes quadratic !!omap duplicate-key detection. The 3.15.x line backports the corresponding security fixes. Changelog: https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md
• ws 8.21.x adds fragment/buffer resource limits and related security hardening. Releases 8.21.1–8.21.3 remain within the existing v8 line; 8.21.3 also fixes client_max_window_bits negotiation. Comparison: websockets/ws@8.21.0...8.21.3

Compatibility assessment

Risk: low. All changes are transitive and remain within their existing major versions. js-yaml adds conservative safety limits for malformed/untrusted YAML; normal project YAML is unaffected. ws remains API-compatible in v8, with stricter resource limits and protocol validation.

Validation

• npm ci --ignore-scripts — passed
• npm run format:check — passed
• npm run build — passed
• npm test -- --runInBand — passed (56 suites, 920 tests)
• npm audit — all js-yaml and ws findings are gone; remaining findings are unrelated and already covered by open security PRs fix(security): patch brace-expansion CPU denial of service #61 and fix(security): update PostCSS for GHSA-r28c-9q8g-f849 #62 (plus one low-severity Babel alert)

Limitations

Validation did not exercise live Obsidian or external integrations; this PR changes generated lockfile metadata only.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5a05ca60-06cc-4508-8384-44bf55333e5b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}