Bump js-yaml to 4.3.1 in the Kotlin/JS lock

[menjoo]

Closes the js-yaml Dependabot alert on kotlin-js-store/yarn.lock. One resolved lockfile entry, nothing else.

The advisory

GHSA-5p4m-2wfm-xmqj / CVE-2026-59870, high severity. !!omap resolution enforces key uniqueness with Array.indexOf() inside a loop, so parsing a document with many entries costs O(n²) CPU and blocks the event loop.

Affected: >= 4.0.0, < 4.3.1. The fix landed in 5.2.1 and was backported to 4.3.1 on 2026-07-31 — the advisory title predates that backport, so it reads as though 4.x is stranded when it isn't.

The change

js-yaml reaches us through mocha, which asks for ^4.1.0, so the range already admits 4.3.1 and nothing else in the tree moves — 4.3.1 keeps the same single dependency, argparse "^2.0.1", already locked at 2.0.1. examples/calculator/kotlin-js-store/yarn.lock is already on 4.3.1 and is untouched.

Verified by resolving js-yaml@^4.1.0 with the yarn 1.22.22 that Kotlin pins, against the live registry: it produces this stanza byte for byte — version, resolved URL, integrity hash and dependency block. CI is green on this commit.

Why the other four advisories are not here

An audit of both lockfiles turned up four more findings, and an earlier revision of this PR fixed them. That work was reverted deliberately.

Package	Locked	Advisory	Severity
serialize-javascript	6.0.2	GHSA-5c6j-r48x-rmvq (RCE)	high
serialize-javascript	6.0.2	GHSA-qj8w-gfj5-8c6v	moderate
diff	7.0.0	GHSA-73rr-hh4g-fpgx	low
webpack	5.101.3	GHSA-8fgc-7cc6-rx7x, GHSA-38r7-794h-5758	low

None of them is reachable, and none of them ships:

• There are no npm(...) declarations anywhere in the build. Published artifacts are klibs and jars whose only runtime dependency is kotlinx-coroutines-core. mocha, karma and webpack exist solely to run the test suite on the JS and Wasm targets.
• Consumers generate their own yarn.lock from their own Kotlin version, so pins here never reach them.
• Each advisory needs attacker-controlled input and there is none: js-yaml parses our .mocharc, diff renders diffs of our own test values, serialize-javascript moves our own test results between mocha workers, and the webpack SSRF requires experiments.buildHttp, which the Kotlin plugin does not enable.

Unlike js-yaml, none could be fixed by a lockfile entry. mocha declares diff ^7.0.0 and serialize-javascript ^6.0.2 and every published 11.x still does, so both needed yarn resolutions forcing a major past the declared range; webpack needed the Kotlin plugin's own version knob. That cost a convention plugin, two lockfile regenerations, and a standing obligation to re-check the pins on every Kotlin upgrade — since a pin ahead of Kotlin today holds a package back tomorrow.

Then CI settled it: webpack 5.104.1 broke wasmJsBrowserTest. It changed how import.meta is statically analysed, Kotlin/Wasm's JS glue uses it, and the bundle failed with Uncaught SyntaxError: Cannot use 'import.meta' outside a module. A low-severity, unreachable, build-time-only advisory had broken a working test suite.

The remaining four are better handled as Dependabot dismissals ("vulnerable code is not actually used") than as forced pins.

Note for whoever does that: there is no committed package.json anywhere — the Kotlin plugin generates it into build/ — so Dependabot has no devDependencies to read and treats this dev-only test tooling as production dependencies. That is probably why it pages at all.