From 97dd89e85b78c0b0fbfd16a6dd63426f9f88e1f7 Mon Sep 17 00:00:00 2001
From: "linear-code[bot]" <222613912+linear-code[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 13:38:41 +0000
Subject: [PATCH 1/2] chore: upgrade js-yaml to ^4.3.0 to address
 CVE-2026-59869

Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1551/sourcebot-devsourcebot-cve-2026-59869-js-yaml-js-yaml-denial-of#agent-session-a1c6a603)

Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 3 +++
 yarn.lock    | 6 +++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ce01f93fa..607098edc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Upgraded `js-yaml` to `^4.3.0`. [#1466](https://github.com/sourcebot-dev/sourcebot/pull/1466)
+
 ## [5.1.3] - 2026-07-20
 
 ### Added
diff --git a/yarn.lock b/yarn.lock
index 54653dc8d..ca2a6a879 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -16831,13 +16831,13 @@ __metadata:
   linkType: hard
 
 "js-yaml@npm:^4.1.1":
-  version: 4.2.0
-  resolution: "js-yaml@npm:4.2.0"
+  version: 4.3.0
+  resolution: "js-yaml@npm:4.3.0"
   dependencies:
     argparse: "npm:^2.0.1"
   bin:
     js-yaml: bin/js-yaml.js
-  checksum: 10c0/1916456c118746603b067d74bbcbb0445d9a1d5e474ad4ae775e7b20525bed902e01d9d97dd0c81fcd8d4f596162309d0eb057f4aa38f3e9647f14075e9dea45
+  checksum: 10c0/058b30473d6915ca5b4feb11e2f7d4d97242f98d00a798ed48dd90b46b7c640398afe9128c5db22c5300f8c6528fe2a174b9a93f351a70ebc28c6203938d8bff
   languageName: node
   linkType: hard
 

From 34dfd2a0f6b14bb33edd574abd123cdfcf56f16f Mon Sep 17 00:00:00 2001
From: "linear-code[bot]" <222613912+linear-code[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 13:39:03 +0000
Subject: [PATCH 2/2] chore: fix changelog PR link

Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1551/sourcebot-devsourcebot-cve-2026-59869-js-yaml-js-yaml-denial-of#agent-session-a1c6a603)

Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>
---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 607098edc..bcb716d08 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,7 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Fixed
-- Upgraded `js-yaml` to `^4.3.0`. [#1466](https://github.com/sourcebot-dev/sourcebot/pull/1466)
+- Upgraded `js-yaml` to `^4.3.0`. [#1470](https://github.com/sourcebot-dev/sourcebot/pull/1470)
 
 ## [5.1.3] - 2026-07-20