chore(deps-dev): bump js-yaml from 4.2.0 to 4.3.1

[dependabot]

Bumps js-yaml from 4.2.0 to 4.3.1.

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

• [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

• Restore umd builds back to es5.

Removed

• [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Commits

• 86e91b8 4.3.1 released
• c3cc4b0 Backport quadratic complexity fix for !!omap
• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• 6842ef6 doc polish
• See full diff in compare view

[github-actions]

depsound · 1 dependency change · review the changes

• npm:js-yaml 4.2.0 → 4.3.1: generated code changed (dist/js-yaml.mjs, +/-5,454 lines): outside the review surface, worth a look; hooks that run only for a git/link/file dependency: prepack changed (git/non-registry installs only); a registry install does not run these; fixes 2 advisory(ies)

Checked: the published artifact diff, manifest compatibility, install/build execution surface. Not checked: runtime behaviour, intent (an obfuscated payload reads as ordinary code), whether your code reaches the change, your test coverage.

Continue locally, the full per-file analysis and a grep-able workspace (trees + stats.json) are available for agent investigation:

go run github.com/rvagg/depsound/cmd/depsound@v0.35.1 npm:js-yaml 4.2.0 4.3.1

Or hand this PR to an agent: point it at the PR and the review skill for a proceed/hold call.

_{depsound · full report + logs}

[rvagg]

@dependabot rebase