security: js-yaml DoS vulnerability via @redocly/openapi-core transitive dependency

[farnalabs]

Problem: npm audit reports 2 high-severity vulnerabilities in js-yaml (4.0.0 - 4.3.1) via @redocly/openapi-core transitive dependency. The vulnerability (GHSA-2883-xcg3-v3hh) allows DoS through maxTotalMergeKeys not limiting CPU use for empty merge sources.

Root cause: @redocly/openapi-core depends on a vulnerable version of js-yaml. This is a transitive dependency in the frontend devDependencies.

Fix plan: Run npm audit fix in frontend/ to update the transitive dependency to a patched version. This is a mechanical fix (XS size).

Size: XS | Detector: npm-audit | Severity: Major

[farnalabs]

Already remediated on main - closing.

frontend/pnpm-workspace.yaml scopes the vulnerable transitive dependency:

@redocly/openapi-core>js-yaml: 4.3.2

GHSA-2883-xcg3-v3hh / CVE-2026-84375 lists the 4.x vulnerable range as >= 4.0.0, < 4.3.2 with first patched version 4.3.2 (the scoped pin was added for FAR-646). The residual js-yaml 4.x pin is intentional and documented in-file: @redocly/openapi-core pins 4.3.1 exactly because its adapter reads the types export that js-yaml 5.x removed; the scoped override lifts it to the patched 4.3.2 and is to be removed once openapi-typescript moves to @redocly/openapi-core 2.x (js-yaml ^5.2.2).

No action remaining.