fix(deps): bump js-yaml override to ^4.3.1 for CVE-2026-59870

[chaliy]

What changed

Raises the pinned js-yaml pnpm override from ^4.3.0 to ^4.3.1 in both npm
workspaces (site/ and crates/bashkit-js/) and refreshes both lockfiles.
Resolves Dependabot alerts #102 and #103. No API or behavior change — js-yaml
is a transitive dependency in both trees (Astro's markdown frontmatter handling
in site/, @napi-rs/cli + ava/supertap dev tooling in crates/bashkit-js/).

Why

js-yaml 4.3.0 is vulnerable to quadratic CPU consumption during !!omap
resolution — GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 (High).

The alert title says the fix was "not backported" to 4.x, but the advisory's own
affected ranges say otherwise: >=4.0.0 <4.3.1 and >=3.0.0 <3.15.1. 4.3.1 is
the patched 4.x release, so a patch bump closes it.

Deliberately not moving to 5.x:

• It is a breaking major for every consumer in these trees.
• 5.x carries its own open DoS advisory (GHSA-pm4m-ph32-ghv5, exponential
  parsing time in flow collections, fixed in 5.2.2), so it is not a strictly
  safer branch.

Before / After

Resolved version in both trees:

# before
$ ls node_modules/.pnpm | grep js-yaml
js-yaml@4.3.0

# after
$ ls node_modules/.pnpm | grep js-yaml
js-yaml@4.3.1

site/ builds clean on the new lockfile — 40 pages plus all 10 postbuild
verifiers:

[build] 40 page(s) built in 8.30s
[build] Complete!
Verified 33 docs route metadata entries.
Verified 33 docs Markdown routes and negotiation helpers.
Verified generated HTML has no local markdown links.
Verified 40 generated HTML route(s) in sitemap.xml.
Verified robots.txt Content Signals.
Verified 1 Agent Skills discovery entry.
Verified homepage Link response headers.
Verified crawler-reported meta descriptions.
Verified llms.txt and llms-full.txt (33 guides indexed) and /llms.txt back-links.

crates/bashkit-js/ installs frozen and lints clean (0 errors; the 3 warnings
are pre-existing unused-import notices unrelated to this change).

The lockfile diffs touch only the js-yaml entries — 6 lines each, no
transitive resolution drift.

CI: 34/34 checks green on cff2410.

Risk

• Low
• A patch-level bump of a transitive YAML parser. Worst case is a parser
  regression in Astro's frontmatter handling or in the napi/ava dev tooling; the
  site build exercises the former end to end and passes.

Checklist

• Tests added or updated — n/a for a dependency bump; verified via full
  site build + postbuild verifiers and bashkit-js frozen install/lint
• Backward compatibility considered — patch bump within the 4.x line, no
  API change

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	cff2410	Commit Preview URL Branch Preview URL	Aug 08 2026, 05:49 PM