Dashboard › craft › Session 0p9huPnrJI77
0p9huPnrJI77MshM9You are performing an adversarial, READ-ONLY pre-merge review of a security-fix PR in the repo /home/byk/Code/getsentry/craft (getsentry/craft). Do NOT make any edits, commits, or destructive actions. Only read files and run read-only commands (git diff/log/show, grep, npm view, gh pr view, gh api). Be skeptical and verify every claim independently.
fix/dependabot-js-yaml-dos (currently checked out). Base: master (origin/master).gh pr view 841).js-yaml GHSA-h67p-54hq-rp68 / CVE-2026-53550 ("Quadratic-complexity DoS in merge key handling via repeated aliases", MEDIUM). Vulnerable >= 4.0.0, <= 4.1.1, first patched 4.2.0.js-yaml is a direct devDependency, previously pinned exactly to 4.1.1 in package.json. Fix: bumped the exact pin to 4.2.0.docs/): js-yaml is transitive (via astro/starlight). Fix: added "js-yaml": "^4.2.0" to docs/package.json pnpm.overrides, which resolved to 4.3.0.pnpm install.Diff scope: Run git diff origin/master...HEAD. Confirm the ONLY changed files are package.json, pnpm-lock.yaml, docs/package.json, docs/pnpm-lock.yaml. Flag any unexpected files (e.g. .lore.md, AGENTS.md, .opencode/, unrelated source), and any NON-js-yaml package version drift in either lockfile (there should be none).
Vulnerability resolved everywhere: Confirm NO js-yaml@4.1.1 (or anything <= 4.1.1 and >= 4.0.0) remains in EITHER pnpm-lock.yaml or docs/pnpm-lock.yaml. Confirm resolved versions are >= 4.2.0 (root 4.2.0, docs 4.3.0). Note that @types/js-yaml is a separate type-defs package and is NOT the vulnerable package — confirm you understand this and that it isn't being confused for ...
I'm starting an adversarial review by organizing my approach and running some initial read-only checks to investigate the system independently.
I'll perform this adversarial review systematically. Let me start by setting up tracking and gathering initial data.
[
{
"content": "Verify diff scope (only 4 expected files, no drift)",
"status": "in_progress",
"priority": "high"
},
{
"content": "Confirm no vulnerable js-yaml remains in either lockfile",
"status": "pending",
"priority": "high"
},
{
"content": "Verify version validity & safety (npm existence, pins)",
"status": "pending",
"priority": "high"
},
{
"content": "Check consumer compatibility of js-yaml ranges",
"status": "pending",
"priority": "medium"
},
{
"content": "Verify PR description accuracy",
"status": "pending",
"priority": "medium"
},
{
"content": "Confirm convention consistency (pin vs override)",
"status": "pending",
"priority": "low"
},
{
"content": "Optionally run pnpm lint",
"status": "pending",
"priority": "low"
},
{
"content": "Write report to /tmp/opencode/pr841-review.md",
"status": "pending",
"priority": "high"
}
]
Let me gather the git state, diff, and PR info in parallel.
On branch fix/dependabot-js-yaml-dos Your branch is up to date with 'origin/fix/dependabot-js-yaml-dos'. Untracked files: (use "git add <file>..." to include in what will be committed) .opencode/ nothing added to commit but untracked files present (use "git add" to track) ===BRANCH=== fix/dependabot-js-yaml-dos ===LOG=== ca5300f fix(deps): bump js-yaml to >=4.2.0 to resolve GHSA-h67p-54hq-rp68 035046d fix(deps): bump @babel/core to ^7.29.6 to resolve GHSA-4x5r-pxfx-6jf8 (#839) 532e010 meta: Bump new development version 078c9b1 Merge branch 'release/2.26.13' e724996 release: 2.26.13 ===MERGE-BASE=== 035046d357228a8d11eb2f887b101c2f0a0254da
docs/package.json | 3 ++- docs/pnpm-lock.yaml | 17 +++++++++-------- package.json | 2 +- pnpm-lock.yaml | 12 ++++++------ 4 files changed, 18 insertions(+), 16 deletions(-) ===NAME-ONLY=== docs/package.json docs/pnpm-lock.yaml package.json pnpm-lock.yaml
{"additions":18,"baseRefName":"master","body":"## Summary\n\nResolves 3 Dependabot alerts (**#186, #187, #188**), all the same advisory across both projects.\n\n- **Advisory:** [GHSA-h67p-54hq-rp68](https://github.com/advisories/GHSA-h67p-54hq-rp68) / CVE-2026-53550 — *js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases* (medium severity)\n- **Vulnerable:** \\`>= 4.0.0, <= 4.1.1\\` → **patched:** \\`4.2.0\\`\n\nThese alerts were opened by the post-merge rescan right after #839 landed (newly-published advisory), not caused by that change.\n\n## Fix\n\n| Alert | Manifest | Relationship | Change |\n|---|---|---|---|\n| #187 | root \\`package.json\\` | direct devDep | bump pinned \\`js-yaml\\` \\`4.1.1\\` → \\`4.2.0\\` |\n| #188 | root \\`pnpm-lock.yaml\\` | direct devDep | regenerated → \\`4.2.0\\` |\n| #186 | \\`docs/pnpm-lock.yaml\\` | transitive (astro/starlight) | \\`pnpm.overrides\\` \\`js-yaml: ^4.2.0\\` → resolves to \\`4.3.0\\` |\n\n- Root uses an exact ...
The diff looks good—only the four expected files are included, and .opencode/ isn't tracked, so there's no unnecessary churn. Let me examine the actual changes now.
Diff scope is clean — only the 4 expected files, .opencode/ is untracked (not part of the commit). Let me examine the actual diffs.
diff --git a/docs/package.json b/docs/package.json
index 5d74281..863e78d 100644
--- a/docs/package.json
+++ b/docs/package.json
@@ -20,7 +20,8 @@
"svgo": "^4.0.1",
"smol-toml": "^1.6.1",
"defu": "^6.1.5",
- "vite": "^7.3.5"
+ "vite": "^7.3.5",
+ "js-yaml": "^4.2.0"
}
}
}
diff --git a/package.json b/package.json
index 042c508..94e0b70 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
"git-url-parse": "^16.1.0",
"glob": "^11.0.0",
"is-ci": "^2.0.0",
- "js-yaml": "4.1.1",
+ "js-yaml": "4.2.0",
"mkdirp": "^1.0.4",
"mustache": "3.0.1",
"nock": "^13.2.4",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 16b96ab..ad3b6f2 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -151,8 +151,8 @@ importers:
specifier: ^2.0.0
version: 2.0.0
js-yaml:
- specifier: 4.1.1
- version: 4.1.1
+ specifier: 4.2.0
+ version: 4.2.0
mkdirp:
specifier: ^1.0.4
version: 1.0.4
@@ -2330,8 +2330,8 @@ packages:
js-tokens@4.0.0:
resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
- js-yaml@4.1.1:
- resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
+ js-yaml@4.2.0:
+ resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==}
hasBin: true
jsesc@3.1.0:
@@ -3731,7 +3731,7 @@ snapshots:
globals: 14.0.0
ignore: 5.3.2
import-fresh: 3.3.1
- ...
diff --git a/docs/pnpm-lock.yaml b/docs/pnpm-lock.yaml
index bc9905c..ec3e3c7 100644
--- a/docs/pnpm-lock.yaml
+++ b/docs/pnpm-lock.yaml
@@ -12,6 +12,7 @@ overrides:
smol-toml: ^1.6.1
defu: ^6.1.5
vite: ^7.3.5
+ js-yaml: ^4.2.0
importers:
@@ -1231,8 +1232,8 @@ packages:
resolution: {integrity: sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw==}
engines: {node: '>=16'}
- js-yaml@4.1.1:
- resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
+ js-yaml@4.3.0:
+ resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==}
hasBin: true
jsonc-parser@3.3.1:
@@ -1943,7 +1944,7 @@ snapshots:
dependencies:
'@types/hast': 3.0.4
'@types/mdast': 4.0.4
- js-yaml: 4.1.1
+ js-yaml: 4.3.0
picomatch: 4.0.4
retext-smartypants: 6.2.0
shiki: ...
Looking at the version bump across the dependency tree, js-yaml is being updated from 4.1.1 to 4.2.0 consistently throughout the lock file—both as a direct dependency and as a transitive dependency used by eslintrc, with all references resolving to the same version.
Now I need to verify that these versions actually exist on npm and check what version ranges the consumers are declaring for js-yaml to ensure compatibility.
Diffs are 100% js-yaml-scoped. Now let me verify no vulnerable versions remain and check npm registry.
=== ROOT lockfile js-yaml refs ===
81: '@types/js-yaml':
153: js-yaml:
1554: '@types/js-yaml@4.0.9':
2333: js-yaml@4.2.0:
3734: js-yaml: 4.2.0
4711: '@types/js-yaml@4.0.9': {}
5594: js-yaml@4.2.0:
=== DOCS lockfile js-yaml refs ===
15: js-yaml: ^4.2.0
771: '@types/js-yaml@4.0.9':
1235: js-yaml@4.3.0:
1947: js-yaml: 4.3.0
1969: js-yaml: 4.3.0
1995: js-yaml: 4.3.0
2076: '@types/js-yaml': 4.0.9
2086: js-yaml: 4.3.0
2653: '@types/js-yaml@4.0.9': {}
2740: js-yaml: 4.3.0
3318: js-yaml@4.3.0:
=== npm view js-yaml 4.2.0 === version = '4.2.0' dist.integrity = 'sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==' === npm view js-yaml 4.3.0 === version = '4.3.0' dist.integrity = 'sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==' === all 4.x versions === "4.0.0" "4.1.0" "4.1.1" "4.2.0" "4.3.0"
I'm verifying that the vulnerable js-yaml@4.1.1 has been completely removed from both lockfiles, with only version 4.2.0 remaining, while the separate @types/js-yaml package stays at 4.0.9, and confirming the npm package integrity for the updated version. I'm checking the dependency ranges declared by the consuming packages across the codebase—down-remark, rehype modules, @astrojs/starlight, astro, and @eslint/eslintrc—to confirm they all accept the 4.3.0 version being forced by the override. Since js-yaml is at 4.x and these consumers almost certainly use ^4.0.0 or similar, the pinned version should be compatible across the board.
No vulnerable versions remain. Both integrity hashes match npm exactly (4.2.0 and 4.3.0), and the only patched 4.x versions are 4.2.0/4.3.0. Now let me verify consumer compatibility ranges and root usage.
=== root consumer @eslint/eslintrc js-yaml range === ^4.1.0 === docs consumers ranges === --- @astrojs/markdown-remark@6.4.0 --- npm error code E404 npm error 404 No match found for version 6.4.0 npm error 404 npm error 404 The requested resource '@astrojs/markdown-remark@6.4.0' could not be found or you do not have permission to access it. npm error 404 npm error 404 Note that you can also install from a npm error 404 tarball, folder, http url, or git url. npm error A complete log of this run can be found in: /home/byk/.npm/_logs/2026-07-01T13_28_56_219Z-debug-0.log --- @astrojs/starlight@0.36.0 --- ^4.1.0 --- astro@5.16.4 --- ^4.1.1
=== root js-yaml usage in src ===
src/targets/pubDev.ts:10:import { load, dump } from 'js-yaml';
src/utils/detection.ts:3:import { load } from 'js-yaml';
src/utils/strings.ts:1:import { dump } from 'js-yaml';
src/utils/workspaces.ts:3:import { load } from 'js-yaml';
src/utils/changelog.ts:4:import { load } from 'js-yaml';
src/config.ts:4:import { load } from 'js-yaml';
=== import styles ===
src/targets/pubDev.ts:10:import { load, dump } from 'js-yaml';
src/utils/detection.ts:3:import { load } from 'js-yaml';
src/utils/strings.ts:1:import { dump } from 'js-yaml';
src/utils/workspaces.ts:3:import { load } from 'js-yaml';
src/utils/changelog.ts:4:import { load } from 'js-yaml';
src/config.ts:4:import { load } from 'js-yaml';
I'm checking the consumer compatibility for these dependencies—the root eslint config and the docs packages all accept their newer versions, but I need to verify the actual markdown-remark version in the lockfile since it's not showing up as expected.
Root usage is standard load/dump named imports — API-stable across 4.x. Consumer ranges all accept the bumped versions (^4.1.0/^4.1.1). Let me confirm the exact consumer versions in the docs lockfile and the markdown-remark range.
=== consumer package versions in docs lockfile (context around js-yaml deps) ===
--- around line 1947 ---
'@astrojs/compiler@4.0.0': {}
'@astrojs/internal-helpers@0.10.0':
js-yaml: 4.3.0
--- around line 1969 ---
js-yaml: 4.3.0
--- around line 1995 ---
js-yaml: 4.3.0
--- around line 2086 ---
js-yaml: 4.3.0
--- around line 2740 ---
js-yaml: 4.3.0
45: '@astrojs/markdown-remark@7.1.0': 48: '@astrojs/markdown-remark@7.1.1': 51: '@astrojs/markdown-remark@7.2.0': 54: '@astrojs/mdx@5.0.4': 71: '@astrojs/starlight@0.38.3': 843: astro@6.4.8: 1619: remark-rehype@11.1.2: 1962: '@astrojs/markdown-remark@7.1.0': 1988: '@astrojs/markdown-remark@7.1.1': 2014: '@astrojs/markdown-remark@7.2.0': 2036: '@astrojs/mdx@5.0.4(astro@6.4.8(@types/node@25.0.3)(rollup@4.62.2))': 2069: '@astrojs/starlight@0.38.3(astro@6.4.8(@types/node@25.0.3)(rollup@4.62.2))': 2713: astro@6.4.8(@types/node@25.0.3)(rollup@4.62.2): 4049: remark-rehype@11.1.2:
I need to verify the actual package versions being used rather than relying on my earlier npm queries. Looking at the real consumer versions: @astrojs/markdown-remark has 7.1.0, 7.1.1, and 7.2.0, @astrojs/mdx is at 5.0.4, @astrojs/starlight is at 0.38.3, and astro is at 6.4.8. Now I'm checking what js-yaml version ranges these packages actually depend on.
Let me check js-yaml ranges for the actual consumer versions present in the lockfile.
--- @astrojs/markdown-remark@7.2.0 js-yaml range --- --- @astrojs/markdown-remark@7.1.0 js-yaml range --- ^4.1.1 --- @astrojs/starlight@0.38.3 js-yaml range --- ^4.1.0 --- astro@6.4.8 js-yaml range --- ^4.1.1 --- @astrojs/internal-helpers@0.10.0 js-yaml range --- ^4.1.1
I'm noticing that markdown-remark@7.2.0 came back empty when I checked for js-yaml dependencies, which is odd since earlier versions like 7.1.0 and 7.1.1 do declare it with the ^4.1.1 range. Let me verify whether 7.2.0 actually dropped the js-yaml dependency or if it's declared differently.
=== markdown-remark 7.2.0 full js-yaml check === (empty above = not a direct dep in 7.2.0) === confirm no 4.0.0-4.1.1 js-yaml anywhere in either lock === NONE FOUND (good)
> @sentry/craft@2.27.0-dev.0 lint /home/byk/Code/getsentry/craft > eslint --cache --cache-strategy content /home/byk/Code/getsentry/craft/src/commands/publish.ts 441:14 warning '_abortError' is defined but never used @typescript-eslint/no-unused-vars 458:14 warning '_abortError' is defined but never used @typescript-eslint/no-unused-vars 474:16 warning '_statusError' is defined but never used @typescript-eslint/no-unused-vars 480:18 warning '_diffError' is defined but never used @typescript-eslint/no-unused-vars 486:16 warning '_abortError' is defined but never used @typescript-eslint/no-unused-vars /home/byk/Code/getsentry/craft/src/utils/git.ts 220:12 warning '_err' is defined but never used @typescript-eslint/no-unused-vars 228:12 warning '_err' is defined but never used @typescript-eslint/no-unused-vars ✖ 7 problems (0 errors, 7 warnings) EXIT: 0
The linting check passed with zero errors and seven pre-existing warnings in files unrelated to this PR, so the claim in the PR body is accurate. I should verify those warnings existed on master before this change to confirm they're not new issues introduced here.
Now I'm checking the advisory details against what's claimed in the PR — the GHSA identifier, severity level, vulnerable version range, and the patched version — along with confirming that tar follows the exact pinning convention used in the root package.json.
Lint passes: 0 errors (the 7 warnings are pre-existing in publish.ts/git.ts, untouched by this PR). Let me verify the convention claim and PR test-count claim.
=== root pinned devDeps (exact, no range operator) ===
51: "js-yaml": "4.2.0",
53: "mustache": "3.0.1",
54: "nock": "^13.2.4",
65: "tar": "7.5.16",
=== docs overrides block ===
"pnpm": {
"overrides": {
"h3": "^1.15.6",
"devalue": "^5.8.1",
"rollup": "^4.59.0",
"svgo": "^4.0.1",
"smol-toml": "^1.6.1",
"defu": "^6.1.5",
"vite": "^7.3.5",
"js-yaml": "^4.2.0"
}
=== verify advisory via github api ===
{"cve":"CVE-2026-53550","ghsa":"GHSA-h67p-54hq-rp68","severity":"medium","summary":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","vulnerable":[{"patched":"4.2.0","pkg":"js-yaml","range":"\u003e= 4.0.0, \u003c= 4.1.1"},{"patched":"3.15.0","pkg":"js-yaml","range":"\u003c 3.15.0"}]}
I'm verifying the advisory details through the GitHub API—the vulnerability identifier, CVE number, severity level, and description all check out, with the vulnerable range affecting js-yaml versions 4.0.0 and above.
The 3.x branch has its own patch, but since the project uses 4.x, that's not relevant here. The pinned version of 4.2.0 in the root package.json aligns with the project's convention for exact pinning, and the docs override follows the same pattern as other dependencies like vite and rollup.
I'm not running the full test suite since it's optional and the task focuses on verification rather than execution, but I should cross-check the Dependabot alert numbers to confirm they map correctly to the affected files.
Advisory fully verified via GitHub API — GHSA, CVE, severity (medium), summary, range (>= 4.0.0, <= 4.1.1), patched (4.2.0) all match the PR. Convention confirmed (js-yaml pinned like tar/mustache; docs override matches vite/rollup style). Let me verify the Dependabot alert mapping and check the #839 timing claim.
{"created":"2026-07-01T13:19:12Z","fixed":null,"manifest":"pnpm-lock.yaml","number":188,"scope":"development","state":"open"}
{"created":"2026-07-01T13:19:11Z","fixed":null,"manifest":"package.json","number":187,"scope":"development","state":"open"}
{"created":"2026-07-01T13:19:11Z","fixed":null,"manifest":"docs/pnpm-lock.yaml","number":186,"scope":"runtime","state":"open"}
=== #839 merge time ===
{"mergedAt":"2026-07-01T13:19:04Z","title":"fix(deps): bump @babel/core to ^7.29.6 to resolve GHSA-4x5r-pxfx-6jf8"}
=== #841 created time ===
{"createdAt":"2026-07-01T13:26:20Z","mergeStateStatus":"BLOCKED","mergeable":"MERGEABLE"}
=== CI checks on 841 ===
Analyze (actions) pass 38s https://github.com/getsentry/craft/actions/runs/28520986369/job/84544814018
Analyze (javascript) pass 52s https://github.com/getsentry/craft/actions/runs/28520986369/job/84544814116
Build pass 14s https://github.com/getsentry/craft/actions/runs/28520988366/job/84544974379
Build Docs pass 27s https://github.com/getsentry/craft/actions/runs/28520988366/job/84544974286
Changelog Preview / Semver Impact pass 0 https://github.com/getsentry/craft/actions/runs/28520988422 Patch
CodeQL pass 2s https://github.com/getsentry/craft/runs/84544926314
Cursor Bugbot pass 21s https://cursor.com/docs/bugbot
Lint ...
I've verified all the Dependabot alerts match the PR body exactly—#187 and #188 are both development scope dependencies, while #186 is runtime scope in the docs folder. The timing checks out too: the PR merged at 2026-07-01T13:19:04Z and the alerts were created just 7-8 seconds later.
The CI status shows all checks passing despite the BLOCKED merge state, which is expected since the branch protection requires an approving review. The alerts still show as "open" because the PR hasn't merged yet—Dependabot will close them automatically once it does. I'm noting the test count as unverified since I didn't run the full suite, but the CI results for both Node 22 and 24 are passing, so that's low-risk. One last thing to check: whether the docs override forcing js-yaml ^4.2.0 could break any consumer that needs the 3.x branch, though that seems unlikely given the advisory scope.
Looking at the lockfile history, there was only ever one js-yaml version resolved (4.1.1 before, now 4.3.0), so ...
All claims verified. Let me record the timing/mapping evidence and write the report.
[
{
"content": "Verify diff scope (only 4 expected files, no drift)",
"status": "completed",
"priority": "high"
},
{
"content": "Confirm no vulnerable js-yaml remains in either lockfile",
"status": "completed",
"priority": "high"
},
{
"content": "Verify version validity & safety (npm existence, pins)",
"status": "completed",
"priority": "high"
},
{
"content": "Check consumer compatibility of js-yaml ranges",
"status": "completed",
"priority": "medium"
},
{
"content": "Verify PR description accuracy",
"status": "completed",
"priority": "medium"
},
{
"content": "Confirm convention consistency (pin vs override)",
"status": "completed",
"priority": "low"
},
{
"content": "Optionally run pnpm lint",
"status": "completed",
"priority": "low"
},
{
"content": "Write report to /tmp/opencode/pr841-review.md",
"status": "in_progress",
"priority": "high"
}
]
Wrote file successfully.
[
{
"content": "Verify diff scope (only 4 expected files, no drift)",
"status": "completed",
"priority": "high"
},
{
"content": "Confirm no vulnerable js-yaml remains in either lockfile",
"status": "completed",
"priority": "high"
},
{
"content": "Verify version validity & safety (npm existence, pins)",
"status": "completed",
"priority": "high"
},
{
"content": "Check consumer compatibility of js-yaml ranges",
"status": "completed",
"priority": "medium"
},
{
"content": "Verify PR description accuracy",
"status": "completed",
"priority": "medium"
},
{
"content": "Confirm convention consistency (pin vs override)",
"status": "completed",
"priority": "low"
},
{
"content": "Optionally run pnpm lint",
"status": "completed",
"priority": "low"
},
{
"content": "Write report to /tmp/opencode/pr841-review.md",
"status": "completed",
"priority": "high"
}
]
Report written to /tmp/opencode/pr841-review.md. No BLOCKER or SHOULD-FIX findings.
What I independently verified:
.opencode/ is untracked (not in the commit); no .lore.md/AGENTS.md churn.grep for js-yaml@4.0.0|4.1.0|4.1.1 across both locks → none. Root resolves to 4.2.0, docs to 4.3.0. @types/js-yaml@4.0.9 is type-defs, correctly not conflated.4.2.0 and 4.3.0 exist on npm and their integrity hashes match the lockfiles exactly; only these two 4.x versions are patched. Exact root pin matches lockfile; docs ^4.2.0 override can't resolve below 4.2.0.^4.1.0/^4.1.1 (root @eslint/eslintrc; docs astro, @astrojs/starlight, markdown-remark, internal-helpers) → all accept the bumps. Root uses stable load/dump API, unaffected by same-major bump.tar/mustache; docs override matches vite/rollup style.pnpm lint exit 0, 0 errors (7 warnings are pre-existing in untouched files). All CI checks green.Only note (NIT): I did not re-run the full test suite, so the "1025 passed" claim is unverified — but CI Node 22/24 both pass and this is a pure version bump. mergeStateStatus: BLOCKED is just the required-review gate, not a failing check.