LTS-4979/LTS-5093: bump fast-uri + js-yaml override floors (security)

[MihirR-BS]

Summary

Fixes two open security tickets on this sample repo's overrides block, whose entries had aged one patch behind the real advisory floors:

• LTS-4979 — GHSA-5jgf-p345-68v8: fast-uri host confusion via skipped IDN canonicalization on scheme-relative references (an incomplete-fix variant of an earlier CVE). Also clears GHSA-f65p-4m7j-42xc (SSRF via malformed IPv6 normalization) and GHSA-fph4-wmhf-6fwf (SSRF via repeated hostname percent-decoding) — all three share the same 3.1.6 floor.
  • fast-uri: 3.1.5 → ^3.1.6
• LTS-5093 — GHSA-2883-xcg3-v3hh: js-yaml maxTotalMergeKeys doesn't count empty merge-source mappings, so a small YAML document can force O(N*K) CPU work despite the configured merge-key limit.
  • js-yaml@3: 3.15.1 → ^3.15.2
  • js-yaml@4: 4.3.1 → ^4.3.2

Both installed majors of js-yaml were vulnerable (kept the existing version-scoped override keys — js-yaml-cloudformation-schema pulls a separate 3.x copy via @kubernetes/client-node's dependents, so a bare override would force it onto 4.x and break safeLoad). Switched all three entries from exact pins to caret ranges — the previous exact pins (fast-uri 3.1.5, js-yaml 3.15.1/4.3.1, landed in #19/#20) are exactly how they aged into newly-disclosed vulnerable ranges; a caret range self-heals within the major as patches ship.

Why fix devDependencies

Every dependency in this repo is a devDependency — there are no runtime deps. That's not a reason to dismiss these as tolerable risk: this is a public, customer-facing repo that customers npm install directly as a Playwright load-testing quickstart. Consistent with prior fixes in this repo family (e.g. ip-address SSRF, brace-expansion DoS), the standing call here is to raise a real fix PR via overrides, not dismiss on a dev-only technicality.

Supersedes #6

Open dependabot PR #6 (Bump js-yaml, branch dependabot/npm_and_yarn/multi-75e6bc5210, opened 2025-11-18) targets js-yaml 4.1.1/3.14.2 — both below the 4.3.2/3.15.2 floor this PR ships, so it would not have closed LTS-5093 even if merged (it also carries an unrelated @playwright/test/browserstack-node-sdk downgrade to stale pins from before the current overrides block existed). This PR supersedes it; left #6 open rather than force-closing someone else's PR — dependabot should auto-close it once this merges, or it can be closed manually.

Verification

• npm ci clean install (node_modules removed first) from the updated lockfile — succeeds.
• npm ls js-yaml --all → js-yaml@4.3.2 (was 4.3.1) and js-yaml@3.15.2 (was 3.15.1), confirming the real installed tree, not just the lockfile.
• npm ls fast-uri --all → fast-uri@3.1.8 (was 3.1.5), resolved by the new caret range.
• npm audit --json → js-yaml and fast-uri no longer appear in vulnerabilities.
• This repo's .npmrc carries min-release-age=7: fast-uri@3.1.6 published 2026-08-23, js-yaml@3.15.2/4.3.2 published 2026-08-26 — all comfortably clear of the 7-day cooldown as of today (2026-09-21).

Scope

Left the other open dependabot PRs (lodash, tar-fs, qs, tmp, jws, playwright) untouched — not in scope for LTS-4979/LTS-5093.

Refs: LTS-4979, LTS-5093

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited), Workspace UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 10fb9d80-cd18-400f-babf-332a1b571324

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}