build(deps): bump js-yaml from 3.14.2 to 3.15.2 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: js-yaml.

Updates js-yaml from 3.14.2 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

Commits

• 5c45bd6 3.15.2 released
• 5a708f9 dist rebuild
• 3485bc0 Backport merge limits from v5.4.1
• f34812f Update .gitignore
• ab85ae2 3.15.1 released
• 30a5e76 dist rebuild
• 22a8071 Backport quadratic complexity fix for !!omap
• c34b6c4 3.15.0 released
• 21e13d3 dist rebuild
• 4165c62 Add v3-legacy tag for publish
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[devex-ai-pr-review]

AI PR Review

🔒 Approval kill switch is active. Auto-approve is off (ApprovalKillSwitch).

💬 Manual DEVEX review required — auto-approval criteria not met.
Change risk: 🔴 High
Service tier: T3

This change updates js-yaml from 3.14.2 to 3.15.2 in the lockfile. The update adds security fixes for merge-key limits and quadratic complexity in the omap parser.

Changes (1 file)

• 🔴 yarn.lock (modified, +3/-3)
  Bumps js-yaml from 3.14.2 to 3.15.2 with updated integrity hash. — flagged by heuristic floor: dependency upgrade classification — js-ts-dependency did not clear this change

Why this verdict

💬 Manual DEVEX review required

• Heuristic floor: dependency change (node, mixed_dep_and_code).
• Change risk: 🔴 High — contract/schema/breaking-grade change, or one that can't be fully reasoned about from the diff.
• Tier policy: T3 service — change risk High exceeds the Medium auto-approval ceiling for this tier; a human must approve.

Skills available

• dependency-update (auto-approves) — Claims PHP, Node, Python, and .NET dependency manifests/lockfiles under source/. Auto-approves minor/patch pins; lockfiles clear for claiming; major or structural edits stay review-only.
• source-code (auto-approves) — Claims application files under source/ (PHP, C#, JSON, YAML, SQL, Markdown, CSV, XML, NEON). Auto-approves for claiming (quality review still via the model); dangerous patterns stay review-only.
• asyncapi-spec (auto-approves) — Claims AsyncAPI at source/docs/asyncapi.yaml and message components under source/docs/asyncapi/**. Auto-approves for claiming (quality/breaking-change review still via the model); dangerous patterns stay review-only.
• docker-compose-local (auto-approves) — Claims docker-compose / compose YAML. Treats image bumps and structural local-stack edits as clearable (local-env risk cap); dangerous patterns stay review-only.
• dockerfile-dependency (auto-approves) — Claims Dockerfiles. Auto-approves minor/patch FROM / ARG VERSION bumps; major or structural Dockerfile edits stay review-only.
• documentation (auto-approves) — Claims Markdown and other documentation files. Auto-approves for claiming (quality review still via the model); dangerous patterns stay review-only.
• github-actions-workflow (auto-approves) — Claims .github/workflows/**. Auto-approves pure minor/patch uses: action@version pin bumps; major or structural workflow edits stay review-only for the LLM.
• js-ts-dependency (auto-approves) — Claims Node package manifests/lockfiles. Auto-approves minor/patch dependency pins in package.json; lockfiles clear for claiming and defer whole-PR floor to change-risk.
• js-ts-source (auto-approves) — Claims JavaScript/TypeScript source, tests, and tooling config. Auto-approves for claiming (quality review still via the model); source without tests stays a HIGH change-risk floor.
• makefile-local (auto-approves) — Claims Makefiles as local-environment changes. Auto-approves unless the patch contains a dangerous pattern.
• openapi-spec (auto-approves) — Claims OpenAPI contracts: openapi-merge.json, root openapi/swagger specs, and fragments under openapi/**. Auto-approves for claiming (quality/breaking-change review still via the model); dangerous patterns stay review-only.
• php-dependency (auto-approves) — Claims Composer manifests/lockfiles. Auto-approves minor/patch dependency pins in composer.json; lockfiles clear for claiming and defer whole-PR floor to change-risk.
• php-source (auto-approves) — Claims PHP source, tests, and tooling config. Auto-approves for claiming (quality review still via the model); source without tests stays a HIGH change-risk floor.

File categories not listed above are unsupported and require manual review. Add a skill module under src/ai_pr_review/skills/<tenant>/ to expand coverage.

---

_{🤖 Generated by ai-pr-review — review limited to files owned by @TransferGo/devex. This comment is updated in place on every commit; approvals are automatically dismissed and re-evaluated when new commits land.}

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml