diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index d4eb67a..ab6b55d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -11,6 +11,8 @@ overrides:
   brace-expansion@<1.1.18: ^1.1.18
   brace-expansion@>=4.0.0 <5.0.9: ^5.0.9
   xcode>uuid: 11.1.1
+  js-yaml@<3.15.2: ^3.15.2
+  js-yaml@>=4.0.0 <4.3.2: ^4.3.2
 
 patchedDependencies:
   image-size@1.2.1: 47b9dd91145f35c3b5349ad9fb3775bac13fc02d305a711a31b69cf285982eef
@@ -3768,12 +3770,12 @@ packages:
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
-  js-yaml@3.15.1:
-    resolution: {integrity: sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==}
+  js-yaml@3.15.2:
+    resolution: {integrity: sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==}
     hasBin: true
 
-  js-yaml@4.3.1:
-    resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==}
+  js-yaml@4.3.2:
+    resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==}
     hasBin: true
 
   jsc-safe-url@0.2.4:
@@ -6531,7 +6533,7 @@ snapshots:
       globals: 13.24.0
       ignore: 5.3.2
       import-fresh: 3.3.1
-      js-yaml: 4.3.1
+      js-yaml: 4.3.2
       minimatch: 3.1.5
       strip-json-comments: 3.1.1
     transitivePeerDependencies:
@@ -6937,7 +6939,7 @@ snapshots:
     dependencies:
       '@babel/code-frame': 7.29.7
       chalk: 4.1.2
-      js-yaml: 4.3.1
+      js-yaml: 4.3.2
 
   '@humanwhocodes/config-array@0.13.0(supports-color@8.1.1)':
     dependencies:
@@ -7077,7 +7079,7 @@ snapshots:
       camelcase: 5.3.1
       find-up: 4.1.0
       get-package-type: 0.1.0
-      js-yaml: 3.15.1
+      js-yaml: 3.15.2
       resolve-from: 5.0.0
 
   '@istanbuljs/schema@0.1.6': {}
@@ -9053,7 +9055,7 @@ snapshots:
       imurmurhash: 0.1.4
       is-glob: 4.0.3
       is-path-inside: 3.0.3
-      js-yaml: 4.3.1
+      js-yaml: 4.3.2
       json-stable-stringify-without-jsonify: 1.0.1
       levn: 0.4.1
       lodash.merge: 4.6.2
@@ -10263,12 +10265,12 @@ snapshots:
 
   js-tokens@4.0.0: {}
 
-  js-yaml@3.15.1:
+  js-yaml@3.15.2:
     dependencies:
       argparse: 1.0.10
       esprima: 4.0.1
 
-  js-yaml@4.3.1:
+  js-yaml@4.3.2:
     dependencies:
       argparse: 2.0.1
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 9d74419..c3abe97 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -44,6 +44,8 @@ minimumReleaseAgeExclude:
   # Let the security fix through the global release-age gate.
   - brace-expansion@1.1.18
   - nanoid@3.3.18
+  - js-yaml@3.15.2
+  - js-yaml@4.3.2
 # pnpm 11 no longer reads the `pnpm` key from package.json, and `overrides` has
 # no other home, so this file carries the old Yarn pins and scoped security
 # fixes. Yarn's `**/a/b` globs become pnpm's `a>b` selectors.
@@ -54,5 +56,10 @@ overrides:
   brace-expansion@<1.1.18: ^1.1.18
   brace-expansion@>=4.0.0 <5.0.9: ^5.0.9
   xcode>uuid: 11.1.1
+  # GHSA-2883-xcg3-v3hh: maxTotalMergeKeys skips empty merge sources, so a
+  # crafted YAML doc burns CPU. Dev-only (eslint, expo CLI, jest coverage),
+  # bumped anyway per Dependabot alerts #57/#58.
+  js-yaml@<3.15.2: ^3.15.2
+  js-yaml@>=4.0.0 <4.3.2: ^4.3.2
 patchedDependencies:
   image-size@1.2.1: patches/image-size@1.2.1.patch
diff --git a/tools/dependency-security-check.mjs b/tools/dependency-security-check.mjs
index 4384dd8..9ad769c 100644
--- a/tools/dependency-security-check.mjs
+++ b/tools/dependency-security-check.mjs
@@ -185,7 +185,7 @@ for (const version of ["0.8.15", "0.9.12"]) {
   assert.throws(serialize, /not a valid XML Name/);
 }
 
-for (const version of ["3.15.1", "4.3.1"]) {
+for (const version of ["3.15.2", "4.3.2"]) {
   const directory = installedPackages.find((entry) =>
     entry.startsWith(`js-yaml@${version}`),
   );
@@ -220,7 +220,9 @@ for (const vulnerablePackage of [
   "@xmldom+xmldom@0.9.10",
   "@xmldom+xmldom@0.9.11",
   "js-yaml@3.15.0",
+  "js-yaml@3.15.1",
   "js-yaml@4.3.0",
+  "js-yaml@4.3.1",
   "nanoid@3.3.16",
   "nanoid@3.3.17",
 ]) {