(jena) 01/02: Bump js-yaml from 4.1.1 to 4.3.2 in /jena-fuseki2/jena-fuseki-ui

[rv...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rvesse pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/jena.git

commit 2acbc135f8f42c1fe5ca1208f2e94740a990e617
Author: Øyvind Gjesdal <oy...@uib.no>
AuthorDate: Wed Oct 7 22:18:26 2026 +0200

    Bump js-yaml from 4.1.1 to 4.3.2 in /jena-fuseki2/jena-fuseki-ui
    
    Updated with:
    
    yarn up -R js-yaml
    
    Fixes two security advisories for dev-dependencies
    
    Explanation from Claude:
    
    The vulnerable copy comes from @cypress/code-coverage (^4.1.1), a dev
    dependency. Dependabot could not update it because
    @istanbuljs/load-nyc-config needs js-yaml ^3.13.1, and it looks for one
    version for both. Updated with `yarn up -R js-yaml`, which re-resolves
    each copy within its own range: lockfile only, no resolutions entry.
    The 3.x copy (3.15.2) is unchanged and already has both fixes.
---
 jena-fuseki2/jena-fuseki-ui/yarn.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/jena-fuseki2/jena-fuseki-ui/yarn.lock b/jena-fuseki2/jena-fuseki-ui/yarn.lock
index ae3749b50e..7a9e391ea5 100644
--- a/jena-fuseki2/jena-fuseki-ui/yarn.lock
+++ b/jena-fuseki2/jena-fuseki-ui/yarn.lock
@@ -5967,13 +5967,13 @@ __metadata:
   linkType: hard
 
 "js-yaml@npm:^4.1.1":
-  version: 4.1.1
-  resolution: "js-yaml@npm:4.1.1"
+  version: 4.3.2
+  resolution: "js-yaml@npm:4.3.2"
   dependencies:
     argparse: "npm:^2.0.1"
   bin:
     js-yaml: bin/js-yaml.js
-  checksum: 10c0/561c7d7088c40a9bb53cc75becbfb1df6ae49b34b5e6e5a81744b14ae8667ec564ad2527709d1a6e7d5e5fa6d483aa0f373a50ad98d42fde368ec4a190d4fae7
+  checksum: 10c0/dedd34c2e8fef1d504687f1bc94ed0ee1311a1f78770fa2800352c6d59c635ccf555009d74e9afe529ae62199da2b1ccef30e53dc84dcd8d2d8187c22574bc97
   languageName: node
   linkType: hard