fix(deps): bump js-yaml overrides to patched 3.15.1 / 4.3.1

[cliffhall]

Fixes #2072

Problem

The root overrides block pinned js-yaml to versions that sit inside the advisory range, so npm audit fix reported "fix available" and then changed nothing — overrides take precedence over anything audit wants to do.

"js-yaml@<4":  "3.15.0",   // advisory range: 3.0.0 - 3.15.0
"js-yaml@>=4": "4.2.0"     // advisory range: 4.0.0 - 4.3.0

Advisories: GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj — CPU-exhaustion DoS on parsing untrusted YAML.

Exposure

Development-only. npm ls js-yaml --omit=dev is empty; both copies are reachable only via eslint -> @eslint/eslintrc and ts-jest -> @jest/transform -> babel-plugin-istanbul -> @istanbuljs/load-nyc-config. Neither ships in the published package, and the only YAML they parse is the repo's own eslint/nyc config. Audit hygiene, not a user-facing exposure — see #2072 for the full assessment.

Change

Both pins bumped to the patched v3-legacy / v4-legacy releases:

"js-yaml@<4":  "3.15.1",
"js-yaml@>=4": "4.3.1"

The patched versions have an identical dependency and bin shape to the ones they replace, so the two lock entries were patched in place (version / resolved / integrity only). Total diff: 8 lines across 2 files, zero transitive churn.

A plain rm -rf node_modules package-lock.json && npm install instead produces a ~2450-line lock diff across 164 packages, including production deps (@modelcontextprotocol/sdk, hono, @hono/node-server 1.x -> 2.x major, jose, ws). That was deliberately avoided — this branch takes security fixes only.

Verification

• js-yaml no longer appears in npm audit
• npm run build ✅ · npm run lint ✅ (prettier + eslint)
• Tests: 539 client + 37 server + 85 CLI, all passing
• App starts and serves the client (HTTP 200); proxy auth gates correctly (401 without token, 200 with)
• Full MCP round-trip through the CLI against a live stdio server: tools/list and tools/call both return correctly

Note on branch policy

AGENTS.md directs agents to file an issue rather than open a PR against v1/main. This PR was opened at the explicit direction of a maintainer (@cliffhall), with #2072 filed and tracked on the Inspector V1 board alongside it.

Not included

• The allowScripts block npm 11.19 writes to package.json (from npm install-scripts deny) is unrelated to this fix and was deliberately left out.
• npm audit on v1/main currently reports 7 further advisories that postdate this one, several production-reachable in the proxy server (hono, @hono/node-server, ip-address, fast-uri — SSRF / host-confusion class). Being assessed separately; more likely to warrant a v1 release than this.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Gq5jMmxRUphrVbfNbYVmQH

[Copilot]

Pull request overview

Updates development-only js-yaml overrides to patched releases, resolving #2072 without unrelated dependency churn.

Changes:

• Bumps legacy 3.x and 4.x override pins.
• Updates corresponding lockfile metadata and integrity hashes.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Pins patched js-yaml versions.
package-lock.json	Updates both resolved package entries.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.