From 3fc68adcd20886cf87d9068896a658bef8c33bdf Mon Sep 17 00:00:00 2001
From: opencode <opencode@kubebase.de>
Date: Thu, 6 Aug 2026 23:09:44 +0200
Subject: [PATCH] chore(security): override js-yaml to >=4.3.1 <5 to fix
 GHSA-5p4m-2wfm-xmqj (orval audit)

---
 pnpm-lock.yaml      | 9 +++++----
 pnpm-workspace.yaml | 3 +++
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b8fde01..6a4bef8 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -173,6 +173,7 @@ overrides:
   linkify-it: '>=5.0.2'
   brace-expansion: '>=5.0.8'
   fast-uri: '>=3.1.4'
+  js-yaml: '>=4.3.1 <5'
 
 importers:
 
@@ -2913,8 +2914,8 @@ packages:
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
-  js-yaml@4.3.0:
-    resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==}
+  js-yaml@4.3.1:
+    resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==}
     hasBin: true
 
   jsesc@3.1.0:
@@ -5780,7 +5781,7 @@ snapshots:
 
   js-tokens@4.0.0: {}
 
-  js-yaml@4.3.0:
+  js-yaml@4.3.1:
     dependencies:
       argparse: 2.0.1
 
@@ -5951,7 +5952,7 @@ snapshots:
       fs-extra: 11.3.5
       get-tsconfig: 4.14.0
       jiti: 2.7.0
-      js-yaml: 4.3.0
+      js-yaml: 4.3.1
       remeda: 2.34.0
       string-argv: 0.3.2
       typedoc: 0.28.19(typescript@7.0.2)
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 5aea61d..e46ea81 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -180,3 +180,6 @@ overrides:
   linkify-it: ">=5.0.2"
   brace-expansion: ">=5.0.8"
   fast-uri: ">=3.1.4"
+  # Fix GHSA-5p4m-2wfm-xmqj: js-yaml (4.x) quadratic CPU in !!omap (via orval)
+  # Keep below 5.x since orval depends on the 4.x API.
+  js-yaml: ">=4.3.1 <5"