From 6e63c3eef9c97f26c921b37eb9d69671b7e65535 Mon Sep 17 00:00:00 2001
From: soyalejolopez <88358406+soyalejolopez@users.noreply.github.com>
Date: Thu, 30 Jul 2026 16:35:56 -0500
Subject: [PATCH] chore(deps): bump js-yaml to 5.2.2 in catalog-build

Resolves Dependabot alert #154 / GHSA-pm4m-ph32-ghv5 (High, CVSS 7.5): exponential parsing time in flow collections can hang the YAML parser. js-yaml is the front-matter engine for the catalog build, and that workflow runs on pull_request, so crafted front-matter could stall the job.

Upstream fix stops the parser reparsing flow sequence pair keys.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 2a30de56-c29b-4893-b8e6-6458251da485
---
 tools/catalog-build/package-lock.json | 8 ++++----
 tools/catalog-build/package.json      | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/tools/catalog-build/package-lock.json b/tools/catalog-build/package-lock.json
index f88685d..febcb6b 100644
--- a/tools/catalog-build/package-lock.json
+++ b/tools/catalog-build/package-lock.json
@@ -9,7 +9,7 @@
       "version": "1.0.0",
       "devDependencies": {
         "gray-matter": "^4.0.3",
-        "js-yaml": "^5.2.1"
+        "js-yaml": "^5.2.2"
       }
     },
     "node_modules/argparse": {
@@ -97,9 +97,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.1.tgz",
-      "integrity": "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==",
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.2.tgz",
+      "integrity": "sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==",
       "dev": true,
       "funding": [
         {
diff --git a/tools/catalog-build/package.json b/tools/catalog-build/package.json
index 295169a..07800af 100644
--- a/tools/catalog-build/package.json
+++ b/tools/catalog-build/package.json
@@ -12,6 +12,6 @@
   },
   "devDependencies": {
     "gray-matter": "^4.0.3",
-    "js-yaml": "^5.2.1"
+    "js-yaml": "^5.2.2"
   }
 }