security: consolidated medium-severity remediation

[lua-stefan-kruger]

Summary

Closes out all three open MEDIUM Dependabot alerts in this repo — all js-yaml,
advisory GHSA-h67p-54hq-rp68 (quadratic-complexity DoS in merge-key handling via
repeated aliases). All are dev-scoped, transitive dependencies.

Fixed via scoped npm overrides that pin each js-yaml line to the patched version
within its existing major (no forced major-version bumps):

Alert	Location	Consumer	Range	Was	Now
#8	root	eslint / @eslint/eslintrc	^4.1.0	4.1.1	4.2.0
#7	root	@istanbuljs/load-nyc-config	^3.13.1	3.14.2	3.15.0
#6	mcp/lua-platform	@istanbuljs/load-nyc-config	^3.13.1	3.14.2	3.15.0

Scoped overrides keep the 3.x and 4.x lines on their own majors — the 3.x coverage
tooling is unaffected by the 4.x API.

Verification (local)

• root: npm ci, npm run lint, npm test -- --coverage (248 tests), check-coverage.mjs — all pass
• mcp: npm ci, npm test (83 tests), npm run build, check-bundle-size.mjs — all pass
• Lockfile diffs are strictly js-yaml version/integrity/funding metadata; no other churn

Only dependency manifests + lockfiles changed. CI is expected to be green.

---

Note

Low Risk
Manifest and lockfile-only changes for dev-scoped transitive dependencies; no runtime or application code paths change.

Overview
Addresses GHSA-h67p-54hq-rp68 (DoS in js-yaml merge-key handling) by pinning transitive dev js-yaml installs through scoped npm overrides, without crossing major versions.

The root package.json now forces js-yaml@^4.1.0 → 4.2.0 (eslint / @eslint/eslintrc) and js-yaml@^3.13.1 → 3.15.0 (@istanbuljs/load-nyc-config). mcp/lua-platform adds the same 3.15.0 override for its Jest/coverage 3.x tree. Lockfiles only reflect the bumped js-yaml versions and metadata.

^{Reviewed by Cursor Bugbot for commit 8313e91. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8313e91. Configure here.}

[cursor]

Incomplete js-yaml security pin

Medium Severity

The new js-yaml@^4.1.0 override pins 4.2.0, which fixes GHSA-h67p-54hq-rp68 but remains in the affected range for high-severity GHSA-52cp-r559-cp3m (fixed in 4.3.0). The exact pin also blocks npm from resolving the patched 4.3.0 release that has been available since late June.

Additional Locations (1)

• package-lock.json#L3307-L3311

 

^{Reviewed by Cursor Bugbot for commit 8313e91. Configure here.}