[dependabot]

Bumps the npm_and_yarn group with 2 updates in the / directory: js-yaml and undici.

Updates js-yaml from 4.3.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

Commits

• 79ca68d 4.3.2 released
• d90b661 Backport merge limits from v5.4.1
• See full diff in compare view

Updates undici from 6.28.0 to 6.29.0

Release notes

Sourced from undici's releases.

v6.29.0

What's Changed

• [v6.x] fix(retry): settle exposed body on terminal failure by @​mcollina in nodejs/undici#5778
• Backport upgrade diagnostics lifecycle fixes to v6.x by @​BridgeAR in nodejs/undici#5833
• test: synchronize the issue-3356 body timeout by @​BridgeAR in nodejs/undici#5834

Full Changelog: nodejs/undici@v6.28.1...v6.29.0

v6.28.1

⚠️ Security fixes

High severity

• GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

• GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

• GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

• perf: reduce EventSourceStream parser allocations (#5032) by @​mcollina in nodejs/undici#5647
• [v6.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) by @​mcollina in nodejs/undici#5770

Full Changelog: nodejs/undici@v6.28.0...v6.28.1

Commits

• e1d0501 Bumped v6.29.0 (#5888)
• 57ac4de test: synchronize the issue-3356 body timeout (#5834)
• 6d44174 Backport upgrade diagnostics lifecycle fixes to v6.x (#5833)
• 2a91fc8 fix(retry): settle exposed body on terminal failure (#5778)
• ffc8aa0 Bumped v6.28.1 (#5773)
• 3866a3b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5770)
• ce31bc8 fix(retry): validate resumed response framing
• 2af0faf fix(websocket): reject unrequested subprotocols
• 07c60d9 fix(websocket): destroy inflater after decompression limit
• bd90fff perf: reduce EventSourceStream parser allocations (#5032) (#5647)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[rudyberends]

zit in dev via faabc53, gaat met de volgende release mee naar main

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml