fix(web): patch js-yaml CPU denial of service

[mmabrouk]

Problem

The web lockfile contains js-yaml 4.2.0 and 4.3.1. Three high-severity advisories allow crafted YAML merge structures to consume excessive CPU:

• Dependabot [Bug Fix]: Resolves Internal Server Error Triggered by Testset Removal in Evaluation Page #986 / GHSA-52cp-r559-cp3m
• Dependabot Error when clicking on "add to test set" with an empy chat #1142 / GHSA-5p4m-2wfm-xmqj
• Dependabot Fix: Evaluation table sorting #1323 / GHSA-2883-xcg3-v3hh

Agenta parses YAML in editors, skill uploads, presets, and trace views.

Change

Resolve every web workspace consumer to js-yaml 4.3.2 through the root pnpm override and regenerate the lockfile.

Validation

• Frozen workspace install passed.
• The resulting lockfile contains only js-yaml 4.3.2.
• pnpm audit no longer reports a js-yaml advisory.
• 83 YAML formatter, upload, and view-type tests passed.
• OSS and EE TypeScript checks passed.

The broader package-local Vitest commands currently hit unrelated React test-harness import failures (act is not a function). The GitHub web suite remains the full regression gate for this exact commit.

Base: release/v0.118.1

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
agenta-documentation	Ready	Preview	Sep 12, 2026 5:47pm UTC

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: c3615371-4023-4f81-84b0-ad9e7c4a0d86

📥 Commits

Reviewing files that changed from the base of the PR and between ff0b416 and 7af956a.

⛔ Files ignored due to path filters (1)

• web/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• web/pnpm-workspace.yaml

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated an internal dependency version constraint for improved consistency and maintenance.

Walkthrough

The workspace configuration adds a pnpm override that pins js-yaml to version 4.3.2.

Changes

Dependency pinning

Layer / File(s)	Summary
js-yaml override web/pnpm-workspace.yaml	The overrides section pins js-yaml to version 4.3.2.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to 7af95

The dependency update is ready to merge; the pinned version is reflected in the lockfile and validation is passing.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the js-yaml security issue, the version override, and the validation results. It directly relates to the changeset.
Title check	✅ Passed	The title clearly and concisely identifies the web fix for the js-yaml CPU denial-of-service vulnerability.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/dependabot-js-yaml-0.118.1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Railway Preview Environment

Status	Destroyed (PR closed)

Updated at 2026-09-12T21:33:50.749Z

[mmabrouk]

Verification evidence

Verified commit 7af956a4c4ed8f0ffae4cf2f3aeb02fc3a36e0df against release/v0.118.1.

• The lockfile resolves every js-yaml consumer to 4.3.2.
• pnpm audit reports no js-yaml advisory.
• Frozen workspace installation passed.
• All 83 affected YAML formatter, skill-upload, and view-type tests passed.
• OSS and EE TypeScript checks passed.
• GitHub's full exact-head matrix passed, including both architecture builds and deployed acceptance tests.

The broader local package test commands encounter unrelated React test-harness import errors. GitHub's isolated web suite passed on this exact commit.