build(deps): Bump js-yaml from 4.1.1 to 4.3.2

[dependabot]

Bumps js-yaml from 4.1.1 to 4.3.2.

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

• [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

• Restore umd builds back to es5.

Removed

• [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

• Added docs/safety.md with notes about processing untrusted YAML.
• Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
• Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
• Added sourcemaps to dist/ builds.

Changed

• Stop resolving numbers with underscores as numeric scalars, #627.
• Switched dev toolchains to Vite / neostandard.
• Updated demo.
• Reorganized tests.
• dist/ files are no longer kept in the repository.

Fixed

• Fix parsing of properties on the first implicit block mapping key, #62.
• Fix trailing whitespace handling when folding flow scalar lines, #307.
• Reject top-level block scalars without content indentation, #280.
• Ensure numbers survive round-trip, #737.
• Fix test coverage for issue #221.
• Fix flow scalar trailing whitespace folding, #307.

... (truncated)

Commits

• 79ca68d 4.3.2 released
• d90b661 Backport merge limits from v5.4.1
• 86e91b8 4.3.1 released
• c3cc4b0 Backport quadratic complexity fix for !!omap
• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• Additional commits viewable in compare view

[flex-development]

lgtm 👍🏾

[flex-development]

lgtm 👍🏾

[codecov]

Bundle Report

Bundle size has no change ✅

[flex-development]

lgtm 👍🏾

[Lex (unicornware)]

Dependabot (@dependabot) rebase

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (195b35e) to head (bba8300).
⚠️ Report is 6 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##              main       #35   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           32        32           
  Lines          820       820           
  Branches       169       169           
=========================================
  Hits           820       820           

Flag	Coverage Δ
bun-canary	100.00% <ø> (ø)
bun-latest	100.00% <ø> (ø)
node22	100.00% <ø> (ø)
node24	100.00% <ø> (ø)
node25	100.00% <ø> (ø)
node26	100.00% <ø> (ø)

Components	Coverage Δ
docmark	100.00% <ø> (ø)
docmark-factory-space	100.00% <ø> (ø)
docmark-grammar	100.00% <ø> (ø)
docmark-util-combine-extensions	100.00% <ø> (ø)
docmark-util-subtokenize	100.00% <ø> (ø)
docmark-util-symbol	100.00% <ø> (ø)

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update afc8967...bba8300. Read the comment docs.

[flex-development]

lgtm 👍🏾