chore(deps-dev): bump js-yaml from 5.2.2 to 5.2.3

[dependabot]

Bumps js-yaml from 5.2.2 to 5.2.3.

Changelog

Sourced from js-yaml's changelog.

[5.2.3] - 2026-08-01

Fixed

• Prevent prototype fallback when resolving tags and mapping entries, #782.
• Resolve !!timestamp years 0000-0099 correctly, #775.
• Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.
• Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

Commits

• 6740445 5.2.3 released
• 94e766d Update changelog
• c3bd7ca Polish previous commit, #780
• 00209b6 presenter: treat a tab-indented line in a folded scalar as more-indented (#780)
• 40fcb4f Fix missing mapping values before document markers and reject unpaired mappin...
• 49280f3 Fix !!timestamp resolution for years 0000-0099, #775
• 355dc96 fix: prevent prototype fallback in tag and harden object lookups, #782 (than...
• d524f83 docs: add contributing guidelines
• See full diff in compare view

[dhensby]

Dependabot review — approved

Change:js-yaml 5.2.2 → 5.2.3 (patch, devDependency)

Check	Result
PR author	dependabot[bot] ✅
Diff scope	package-lock.json only ✅
Publisher	vitaly — unchanged from 5.2.2 ✅
SLSA provenance	none ⚠️ — mitigation below
Source repo	matches nodeca/js-yaml ✅
Install hooks	none new ✅

What changed (5.2.3, 2026-08-01)

• Prevent prototype fallback when resolving tags and mapping entries (#782) — prototype-pollution hardening.
• Resolve !!timestamp years 0000–0099 correctly (#775).
• Preserve implicit null mapping values before document markers; reject unpaired mapping event streams (#784).
• Preserve folded scalar values with tab-indented lines when round-tripping an AST through present() (#780) — dump() and loading unaffected.

All four are correctness/hardening fixes with no API change.

No provenance — confidence rests on publisher continuity (vitaly, unchanged across adjacent versions), a maintainer-pushed source tag, a small reviewable diff, no install hooks, and dev-only scope. nodeca/js-yaml publishes no GitHub releases at all — git tags are the release mechanism, so the absent release is project convention, not an anomaly.

CI

All green — including the full runaction matrix (windows-2022/2025 × sql-2016/2017/2019/2022/latest).

[dhensby]

@dependabot rebase

[dhensby]

Dependabot review — approved

Change:js-yaml 5.2.2 → 5.2.3 (patch, devDependency)

Check	Result
PR author	dependabot[bot] ✅
Diff scope	package-lock.json only ✅
Publisher	vitaly — unchanged from 5.2.2 ✅
SLSA provenance	none ⚠️ — mitigation below
Source repo	matches nodeca/js-yaml ✅
Install hooks	none new ✅

What changed (5.2.3, 2026-08-01)

• Prevent prototype fallback when resolving tags and mapping entries (#782) — prototype-pollution hardening.
• Resolve !!timestamp years 0000–0099 correctly (#775).
• Preserve implicit null mapping values before document markers; reject unpaired mapping event streams (#784).
• Preserve folded scalar values with tab-indented lines when round-tripping an AST through present() (#780) — dump() and loading unaffected.

All four are correctness/hardening fixes with no API change.

No provenance — confidence rests on publisher continuity (vitaly, unchanged across adjacent versions), a maintainer-pushed source tag, a small reviewable diff, no install hooks, and dev-only scope. nodeca/js-yaml publishes no GitHub releases at all — git tags are the release mechanism, so the absent release is project convention, not an anomaly.

CI

All green — including the full runaction matrix (windows-2022/2025 × sql-2016/2017/2019/2022/latest).