[dependabot]

Bumps js-yaml from 4.3.2 to 5.5.0.

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

• Updated argparse to v3.
• Updated development dependencies.

Fixed

• Correct percent-encoding of shorthand and verbatim tags.
• Reject ,, ], and } at the start of block plain scalars, #801.
• Report the exact position of non-printable characters in errors, #801.

[5.4.3] - 2026-10-06

Fixed

• Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

[5.4.2] - 2026-09-13

Fixed

• forceQuotes no longer quotes non-string scalars, #798.

[5.4.1] - 2026-08-26

Changed

• Hard-limit merge sequence size to 100.

Security

• Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

• Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

• [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
• [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
• Reworked scalar style selection. This can change formatting without changing

... (truncated)

Commits

• cb62b2d 5.5.0 released
• 87aed90 Deps bump
• 3aec511 Fix error positions for non-printable characters, #801
• 11aa483 Reject flow indicators at the start of block plain scalars, #801
• 339d8e0 Refactor tag encoder and decoder to match the YAML specification
• 7832624 5.4.3 released
• 0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
• 30108cc Parse the first block mapping key once (#800)
• 494400b 5.4.2 released
• 6d8adb4 Fix forceQuotes quoting non-string scalars, #798
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[monoscope-bot]

Monoscope production impact · Worth checking

Project 87576849-4941-49d3-a15d-680fef88a1a8 · reviewed 66101e525ac10097e2e95659b3eb0f5d87230ba5 · advisory

Evidence window (UTC): 2026-10-19 14:59:52.798596518 UTC → 2026-10-26 14:59:52.798596518 UTC

web-components/package-lock.json:2046 (Base)

Inferred: Several optional platform-package records lose their dev-only classification in the lockfile. Production installs using the lockfile may therefore retain platform-specific optional packages that were previously prunable, increasing install work and image or artifact size.

Next check: Regenerate or inspect the lockfile with the intended production/development dependency graph, then compare production install contents and size before and after; restore dev metadata if these packages are not required at runtime.

telemetry evidence · Observed: 8974563 events · 0 errors · service: srv-captain--monoscope

Coverage: Evidence is capped at 20 service/environment groups, monitors and dashboard queries. Telemetry describes the mapped service, not a proven changed-path or deployed-revision match. Monitor and dashboard references are project-wide; their relationship to the mapped service is unverified. Diff coverage is incomplete: only the first 30 files and 2000 characters per patch are inspected. No telemetry is mapped to the web-components install or YAML parsing path; the available telemetry is for a different service and cannot validate this changed dependency path. No dependency release notes, YAML compatibility tests, or production install and artifact-size measurements were provided.

Review history and settings