Chore | +Claude | Pin js-yaml via npm override to resolve Snyk high-severity finding

[AryanBansal-launch]

Summary

• Fixes SNYK-JS-JSYAML-18593780 (Inefficient Algorithmic Complexity, High severity) in js-yaml@4.3.0, pulled in transitively via @contentstack/cli-utilities, eslint-config-oclif, and mocha.
• Adds a flat js-yaml: ^4.3.1 npm override — all declared ranges (^4.1.0, etc.) already permit the patch bump, so no code changes were needed.
• Updates the .talismanrc checksum for package-lock.json to match the regenerated lockfile hash.

Verification

• npm ci — clean install against the updated lockfile
• npm run build — passes
• npm test — 129/129 Jest tests pass; mocha suite unchanged from baseline (pre-existing local-only failures gated on ORG/ENVIRONMENT/PROJECT env vars not present in this environment, unrelated to this change)
• snyk test — 0 vulnerable paths (was 1 issue / 2 vulnerable paths)

Test plan

• Confirmed via a clean npm ci + re-scan that the fix holds on a fresh install
• No source code changes — dependency-only fix

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

Pins js-yaml via npm overrides to address a high-severity Snyk finding in the transitive dependency graph, and updates the lockfile and secret-scan allowlist checksum accordingly.

Changes:

• Adds an npm override for js-yaml to bump it to ^4.3.1.
• Regenerates package-lock.json to reflect the overridden resolution (including pruning now-unneeded nested deps).
• Updates .talismanrc checksum for the updated lockfile.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
package.json	Adds a js-yaml entry under overrides to force a patched version.
package-lock.json	Updates resolved js-yaml version to 4.3.1 and prunes no-longer-needed nested packages.
.talismanrc	Updates the stored checksum for package-lock.json.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.