fix(deps): upgrade yaml to 2.9.0

[pavel-snyk]

Snyk has created this PR to upgrade yaml from 2.8.1 to 2.9.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 4 versions ahead of your current version.

• The recommended version was released 4 months ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Uncontrolled Recursion SNYK-JS-YAML-15765520	586	Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: yaml

• 2.9.0 - 2026-05-11
  

  The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

  It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

  Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

  • fix: Avoid calling Array.prototype.push.apply() with large source array
  • fix(lexer): Avoid recursive calls that may exhaust the call stack
• 2.8.4 - 2026-05-02
  
  • Disable alias resolution with maxAliasCount:0 (#677)
  • Handle invalid unicode escapes (e1a1a77)
  • Apply minFractionDigits only to decimal strings (#676)
• 2.8.3 - 2026-03-21
  
  • Add trailingComma ToString option for multiline flow formatting (#670)
  • Catch stack overflow during node composition (1e84ebb)
• 2.8.2 - 2025-11-30
  
  • Serialize -0 as -0 (#638)
  • Do not double newlines for empty map values (#642)
• 2.8.1 - 2025-08-05
  
  • Preserve empty block literals (#634)

from yaml GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• Snyk has automatically assigned this pull request, set who gets assigned.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 👩‍💻 Set who automatically gets assigned
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

---

Note

Low Risk
Lockfile-only dependency bump with no application code changes; lowers YAML parsing abuse risk wherever yaml is used on untrusted input.

Overview
Bumps the yaml runtime dependency from 2.8.1 to 2.9.0 in package.json and refreshes package-lock.json (resolved tarball, integrity hash, and package metadata such as funding).

This is a Snyk-driven security upgrade aimed at SNYK-JS-YAML-15765520 (uncontrolled recursion / call-stack exhaustion during parsing). 2.9.0 includes lexer and array-handling hardening around those paths; there are no other repo changes beyond the version pin.

^{Reviewed by Cursor Bugbot for commit 6365a77. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pavel-snyk]

This is a minor version upgrade that the author notes consists of only patch-level changes. The primary change is a documentation update to clarify that parsing functions may throw errors on malicious input, which was always a possibility. The release also includes fixes to prevent call stack exhaustion on very large or complex inputs.

No breaking API changes are documented.

Source: Release notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.