fix(ci): bump js-yaml to 4.3.2 to clear a high-severity CPU-DoS advisory - #290

…ry (#291)

smol-toml <=1.7.0 has a newly-disclosed high-severity advisory
(GHSA-7w5x-hrqm-74c2 / CVE-2026-85730), published/reviewed 2026-09-09:
parse() can be forced into an infinite loop by a value inside an
array or inline table followed by a comment with no trailing newline
(e.g. `a=[1 #`) -- the parser fails to exit its scan for the closing
structure and resets its cursor instead of erroring, pinning CPU at
100% indefinitely.

[email protected] declares [email protected] directly (separate
from the js-yaml/markdown-it overrides already pinned here), so the
same npm audit --audit-level=high step this repo's CI runs started
failing again once this advisory was published -- unrelated to, and
discovered right after, the earlier js-yaml fix (#290).

Bump the override to 1.7.1 (the patched version per the advisory).
Verified: `npm install` now reports 0 vulnerabilities; markdownlint-cli2
stays at the same pinned version (0.22.1) with a real lint pass
against this repo's own docs still reporting 0 errors -- no behavioral
change, pure dependency bump.

Companion fix needed identically in the sibling
agentic-coding-quickstart (GSA-TTS/agentic-coding-quickstart#459) and
agentic-coding-patterns repos, which share this same CI linter setup
and are equally affected.

Co-authored-by: OpenCode Agent <[email protected]>

🤖 I have created a release *beep* *boop*
---


##
[0.15.0](v0.14.1...v0.15.0)
(2026-10-06)


### Features

* **agents:** require human approval to accept licenses; prefer
unencumbered tools
([#163](#163))
([a4179ca](a4179ca))
* **data:** canonical security scanner registry + NIST mapping
([#155](#155))
[MERGE FIRST]
([#157](#157))
([058ad89](058ad89))
* **docs:** frontmatter crosswalk to Dublin Core / schema.org + guard
([#209](#209))
([#213](#213))
([8685971](8685971))
* **generate:** add generated repo-root llms.txt for agent navigation
([#212](#212))
([#218](#218))
([f717345](f717345))
* **generate:** landscape summary/phase + ROADMAP metrics from source
([#142](#142))
([#196](#196))
([aa9aa0c](aa9aa0c))
* **generate:** neutral document inventory from INDEX.yaml
([#199](#199))
([#206](#206))
([c0d6ab4](c0d6ab4))
* **generate:** re-land framework registry + NCCoE casing fix
([#198](#198))
([#223](#223))
([1ba74f8](1ba74f8))
* **generate:** re-land TRACEABILITY control matrix from frontmatter +
NIST OSCAL
([#197](#197))
([#221](#221))
([60313c0](60313c0))
* **meta:** add CITATION.cff; stop calling the repo's own content
'guidance'
([#214](#214))
([#219](#219))
([46ac233](46ac233))
* **validator:** enforce doc freshness — optional stale_after +
staleness check
([#210](#210))
([#216](#216))
([042ad32](042ad32))
* **validator:** guard prose count-drift + generate landscape/control
counts
([#184](#184))
([#188](#188))
([010c41f](010c41f))
* **validator:** guard SECURITY-CONTROLS.md control-count integrity
([#121](#121))
([#170](#170))
([44e0001](44e0001))


### Bug Fixes

* **ci:** bump js-yaml override to 4.3.1 in linters (CVE-2026-59870)
([#194](#194))
([2e77ad8](2e77ad8))
* **ci:** bump js-yaml to 4.3.2 to clear a high-severity CPU-DoS
advisory
([#290](#290))
([e6d2968](e6d2968))
* **ci:** bump smol-toml to 1.7.1 to clear an infinite-loop DoS advisory
([#291](#291))
([e557daf](e557daf))
* **ci:** pin markdownlint-cli2 once, clear GHSA-253c, align the ruff
rev
([#296](#296))
([bf88af6](bf88af6))
* **ci:** promote pre-deploy to gating via per-line self-scan marker
([#263](#263))
([#272](#272))
([cdf4653](cdf4653))
* **ci:** repair Link Check — OWASP agentic URL + relative-path/403
config
([#220](#220))
([6fd93d7](6fd93d7))
* **ci:** replace markdownlint-cli2 with markdownlint-cli
([#304](#304))
([7d0f4b3](7d0f4b3))
* **config:** enforce mandated size/complexity limits; drop vestigial
FRAMEWORK_VERSIONS
([#261](#261))
([#274](#274))
([d5ba978](d5ba978))
* **contract:** copied probe recognizes inline flow-mapping frontmatter
([#154](#154))
([#190](#190))
([f162a9d](f162a9d))
* **contract:** fail closed when the provisioned contract isn't the
universal one
([#262](#262))
([a726bdb](a726bdb))
* **contract:** reconcile contract version to 1.0.0 + guard against
drift
([#191](#191))
([#192](#192))
([bd940a3](bd940a3))
* **deps:** commit uv.lock + require lock files to be git-tracked, not
just present
([#271](#271))
([0daa0da](0daa0da))
* **deps:** resolve npm audit highs in CI linter deps
([#164](#164))
([1be25ec](1be25ec))
* **docs:** correct automation self-docs + guard contract-probe drift
([#250](#250),
[#251](#251))
([#275](#275))
([45f3a80](45f3a80))
* **generate:** generate AGENTS.md nist_controls from body citations
([#238](#238))
([#277](#277))
([d6d1045](d6d1045))
* **generate:** generate PLAYBOOK skill table + fill em-dash word-counts
([#254](#254),
[#256](#256))
([#276](#276))
([9bca89a](9bca89a))
* **landscape:** make FEDERAL-AI-LANDSCAPE.md freshness date evergreen
from the registry
([#142](#142))
([#229](#229))
([cd75062](cd75062))
* **landscape:** scope Federal Register query + source-aware relevance
gate
([#182](#182))
([#195](#195))
([cae911f](cae911f))
* **new-project:** catch backtick dangling refs + exclude playbook-doc
navigators
([#189](#189))
([#201](#201))
([89b9f4a](89b9f4a))
* **skills:** add symlink fallback resolution for playbook-source refs
([#287](#287))
([94be9b9](94be9b9))
* **validators:** correct validate-adrs dir + dependency-pin regex; wire
validators into CI
([#264](#264))
([1e18d2d](1e18d2d))
* **validators:** enforce frontmatter enums, single-source exclusions,
close staleness gap
([#270](#270))
([b7de498](b7de498))


### Documentation

* **a11y:** add Section 508 accessibility statement + document
md-hygiene
([#211](#211))
([#224](#224))
([a250360](a250360))
* add SUPPORT.md and emphasize federal community
([#178](#178))
([#187](#187))
([e43f8ef](e43f8ef))
* **agents:** add Durable-References guidance (ephemeral refs vs NIST
tags)
([#280](#280))
([7f3bece](7f3bece))
* **backend:** make sandbox references backend-agnostic (acq wrapper,
not sbx-only)
([#217](#217))
([380cad3](380cad3))
* **codeowners:** make the security-sensitive review claim honest
([#269](#269))
([1f0b8a5](1f0b8a5))
* de-drift stale version/count stamps + restore orphaned §14.2 heading
([#265](#265))
([2788e37](2788e37))
* frontmatter is a convention (not a standard) + MCP crosswalk column
([#215](#215))
([#225](#225))
([fe33e5a](fe33e5a))
* public-readiness governance files + scope reframe
([#185](#185))
([78cb5ba](78cb5ba))
* remove internal Slack references for public readiness
([#176](#176))
([#186](#186))
([94fdf42](94fdf42))


### Maintenance

* **ci:** automate pre-commit rev updates, guard the ruff dual-pin
([#297](#297))
([0c88615](0c88615))
* **deps:** bump actions/checkout from 7.0.0 to 7.0.1
([#166](#166))
([b16b104](b16b104))
* **deps:** bump actions/setup-python from 6.3.0 to 7.0.0
([#167](#167))
([cf65a76](cf65a76))
* **deps:** bump feedparser from 6.0.12 to 6.0.14
([#205](#205))
([023586a](023586a))
* **deps:** bump https://github.com/astral-sh/ruff-pre-commit from
v0.16.8 to 0.16.9
([#301](#301))
([17b60c0](17b60c0))
* **deps:** bump pre-commit from 4.6.0 to 4.6.1
([#172](#172))
([8e22797](8e22797))
* **deps:** bump pre-commit from 4.6.1 to 4.6.2
([#279](#279))
([89891bd](89891bd))
* **deps:** bump ruff from 0.15.21 to 0.15.22
([#169](#169))
([0b9142a](0b9142a))
* **deps:** bump ruff from 0.15.22 to 0.16.0
([#173](#173))
([69d3bc2](69d3bc2))
* **deps:** bump ruff from 0.16.0 to 0.16.1
([#204](#204))
([2512c33](2512c33))
* **deps:** bump ruff from 0.16.1 to 0.16.2
([#230](#230))
([dbc6ca9](dbc6ca9))
* **deps:** bump ruff from 0.16.2 to 0.16.3
([#278](#278))
([4095253](4095253))
* **deps:** bump ruff from 0.16.3 to 0.16.7
([#294](#294))
([d05c036](d05c036))
* **deps:** bump ruff from 0.16.7 to 0.16.8
([#295](#295))
([1e44d51](1e44d51))
* **deps:** bump ruff from 0.16.8 to 0.16.9
([#300](#300))
([b07a4fd](b07a4fd))
* **deps:** bump tcort/github-action-markdown-link-check
([#203](#203))
([3267760](3267760))
* **deps:** bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0
([#168](#168))
([e73018d](e73018d))
* **deps:** bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1
([#171](#171))
([07ce3ce](07ce3ce))
* **deps:** bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2
([#202](#202))
([1147e4a](1147e4a))
* **deps:** bump zizmorcore/zizmor-action from 0.6.2 to 0.6.4
([#293](#293))
([b47f40b](b47f40b))
* **landscape:** review federal AI registry — no new governance docs
(2026-08-04)
([#181](#181))
([b5e95cc](b5e95cc))


### CI/CD

* check only changed markdown links on PRs
([#283](#283))
([9ea8add](9ea8add))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>