chore(deps): bump js-yaml to 5.2.2 in catalog-build (GHSA-pm4m-ph32-ghv5)

[soyalejolopez]

Bumps js-yaml in tools/catalog-build from 5.2.1 to 5.2.2, closing Dependabot alert #154.

The advisory

GHSA-pm4m-ph32-ghv5 - High, CVSS 7.5. Exponential parsing time in flow collections leads to denial of service. Affects >= 5.0.0, <= 5.2.1, fixed in 5.2.2.

Why it matters here

js-yaml is the front-matter engine for the catalog build (tools/catalog-build/index.js, yaml.load inside the gray-matter parser). build-catalog.yml runs on pull_request and parses markdown from the sample directories, so a crafted front-matter block in a contributed file could stall that job. Dev dependency only, nothing ships to consumers, and the workflow runs with contents: read and no secrets, so this is burned CI minutes rather than an exposure. Still worth patching.

What changed upstream

The 5.2.1...5.2.2 diff is the parser fix plus a regression test: the parser now wraps already-parsed key events in a synthetic flow mapping instead of rewinding and reparsing flow sequence pair keys. No API surface change.

Validation

npm ci and npm run check both pass against the regenerated lockfile.

[github-actions]

🛰️ PR Sweeper report

Risk: 🟢 LOW · Security gate: ✅ passing · Files: 2

🔒 Automated guardrails (authoritative)

No secret, PII, file-policy, or scope issues detected. ✅

🤖 Dual-model AI review (advisory)

AI review unavailable for this run (models not reachable or no diff). Guardrails above are unaffected.

• GPT-class reviewer (openai/gpt-5): skipped — GitHub Models HTTP 410: {"error":{"code":"github_models_retirement_brownout","message":"GitHub Models is temporarily unavailable as part of a scheduled retirement brownout."}}

• Deep-reasoning reviewer (openai/o3): skipped — GitHub Models HTTP 410: {"error":{"code":"github_models_retirement_brownout","message":"GitHub Models is temporarily unavailable as part of a scheduled retirement brownout."}}

---

The automated guardrails are authoritative and gate the security status. The AI review is advisory and never auto-merges. Thanks for contributing to FastTrack! 🛩️