chore(deps): patch high-severity yaml advisories

[ericsocrat]

Purpose

Resolve the two actionable high-severity js-yaml Dependabot alerts without widening dependency scope, and record the bounded reachability disposition for the still-unpatched extract-zip development-tooling alert.

Changes

• refresh only the two existing js-yaml lockfile branches:
  • 3.15.0 -> 3.15.2 under @lhci/utils
  • 4.3.0 -> 4.3.2 under ESLint
• add an executable dependency-security contract for patched versions, exact dev-only ancestry, pinned Playwright Chromium delegation, and absence of repo-owned archive-package imports
• document that Dependabot alert fix(mobile): conditionally render ConfirmDialog and SaveSearchDialog #94 remains open because extract-zip@2.0.1 has no patched release
• preserve LHCI, Lighthouse, Puppeteer, framework, jsdom, Sonner, production dependencies, and application behavior unchanged

Risk disposition

The remaining audit graph is one development-only chain:

@lhci/cli -> lighthouse -> puppeteer-core -> @puppeteer/browsers -> extract-zip

TryVit does not import extract-zip or @puppeteer/browsers. The guarded Lighthouse runner installs pinned Playwright Chromium and supplies its exact executable through CHROME_PATH, so Puppeteer's browser archive installation path is not invoked. Alert #94 is not dismissed and must be reassessed when upstream removes the package or publishes a patch.

Verification

Passed locally:

• clean npm ci --ignore-scripts
• focused dependency-security contract: 3/3
• npm ls js-yaml extract-zip --all
• npm audit --omit=dev --audit-level=high: 0
• full audit: six high graph nodes, all inherited from the single no-patch extract-zip advisory
• type-check
• source lint plus focused test lint
• production build
• repository hygiene 6/6
• strict documentation counts
• migration ordering

Full local Vitest result: 6,895 passed, 19 skipped, one inherited Windows checkout-only failure. The Git blob for MANROPE-OFL.txt still matches the certified 4,383 bytes and SHA-256; CRLF expansion makes the Windows working copy 4,476 bytes. Exact-head Linux CI remains the authoritative immutable-byte check.

Not run:

• Lighthouse, intentionally
• broad browser or visual matrix, because there is no product/UI change
• baseline generation or acceptance

Impact

• Production behavior: none
• Accessibility/UI: none
• Route-JS/runtime bundle: no declared production dependency change
• Immutable baselines: unchanged
• Outstanding: Dependabot fix(mobile): conditionally render ConfirmDialog and SaveSearchDialog #94 remains open with no upstream fix

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tryvit	Ready	Preview	Aug 28, 2026 2:42pm