fix(security): remediate js-yaml vulnerability

[GioDavid]

Summary

Resolves the remaining vulnerable js-yaml install. js-yaml@4.3.2 was already on the patched 4.x release. js-yaml@3.14.2, used only to load Istanbul/nyc coverage config, was still affected by merge-key denial-of-service advisories. It is now 3.15.2.

Advisories fixed for the 3.14.2 install:

• CVE-2026-84375 / GHSA-2883-xcg3-v3hh (CWE-400, CWE-407, high): empty merge sources bypass maxTotalMergeKeys. Fixed in 3.15.2 and 4.3.2.
• CVE-2026-59869 / GHSA-52cp-r559-cp3m (high): merge-key chains can force quadratic CPU use. Fixed in 3.15.0 and 4.3.0.
• CVE-2026-53550 / GHSA-h67p-54hq-rp68 (moderate): repeated merge aliases can force quadratic CPU use. Fixed in 3.15.0 and 4.2.0.

CVE-2025-64718 does not apply to 3.14.2 (patched in 3.14.2). The 5.x advisories do not apply because 5.x is not installed.

This is coverage/test tooling, not the published React Native runtime. load-nyc-config parses local nyc YAML during Jest instrumentation. Attacker-controlled YAML is not on the library's user path. The lockfile still contained an affected version, so it is updated.

Dependency path

Transitive, example workspace, test/coverage tooling:

example
  → react-native@0.84.0
    → babel-jest@29.7.0
      → @jest/transform@29.7.0
        → babel-plugin-istanbul@6.1.1
          → @istanbuljs/load-nyc-config@1.1.0
            → js-yaml@^3.13.1

babel-jest also depends on babel-plugin-istanbul directly. Both paths resolve the same js-yaml 3.x install.

Other installs were already js-yaml@4.3.2 through @eslint/eslintrc, cosmiconfig, read-yaml-file, and semantic-release-yarn. Those ranges stay on 4.3.2, the latest patched 4.x release.

Package-only investigation

@istanbuljs/load-nyc-config@1.1.0 requests js-yaml@^3.13.1, which includes 3.15.2. yarn up -R js-yaml moved only that descriptor from 3.14.2 to 3.15.2. The 4.x descriptor stayed at 4.3.2.

Parent investigation

No non-breaking parent update changes this dependency.

• Immediate parent @istanbuljs/load-nyc-config is already at its latest release, 1.1.0, and still declares js-yaml@^3.13.1.
• babel-plugin-istanbul@6.1.1 is the version selected by Jest 29 (^6.1.1). Even current babel-plugin-istanbul@8.0.2 still depends on @istanbuljs/load-nyc-config@^1.0.0, so a parent bump does not move the js-yaml range.
• babel-jest and @jest/transform are already at 29.7.0, the latest 29.x release pulled in by react-native@0.84.0.
• A React Native, Jest, or Babel-plugin-istanbul major upgrade would be a toolchain migration and would not replace the ^3.13.1 range.

The parent update was not applied because it cannot select the fixed version. The supported fix is the lockfile resolution already allowed by the parent range.

Final remediation

yarn.lock only: js-yaml@^3.13.1 now resolves to 3.15.2.

Why

Package-only is the smallest supported change. It reaches the fixed 3.x release inside the existing range, leaves the already-patched 4.3.2 installs unchanged, and does not require a parent or toolchain upgrade.

Validation

• yarn install
• yarn why js-yaml shows 3.15.2 and 4.3.2 only
• yarn test (22 tests passed)
• yarn lint
• yarn npm audit -A -R reports no js-yaml findings

Scope

This PR only remediates js-yaml. No other vulnerabilities are included.

Test plan

• yarn why js-yaml shows 3.15.2 for @istanbuljs/load-nyc-config and 4.3.2 everywhere else
• yarn test
• yarn lint
• yarn npm audit -A -R has no js-yaml advisory

[GioDavid]

closed because this was solved with dependabot resolver