[dependabot-agent] Bump yaml to 2.9.1 (patch)

[cao-githubnext-gh-aw-cao-write]

Dependency Release Train Summary

What changed

• Package/ecosystem: npm — yaml
• Manifest(s): package.json / package-lock.json (root), dashboard/site/package.json / dashboard/site/package-lock.json
• Old version: 2.9.0
• New version: 2.9.1
• Update type: patch

Why now

• Routine freshness: yaml had a patch release (2.9.1) available in both manifests, which already declare ^2.9.0 (semver-compatible). No open Dependabot alert or existing PR covers this dependency.

Risk assessment

• Runtime/dev/build scope: runtime dependency in the root package (used by docs/lib/catalog.ts, scripts/package-lifecycle-matrix.mjs); dev dependency in dashboard/site (used by dashboard/site/src/validator.js and its build tooling).
• Direct/transitive: direct dependency in both manifests.
• Reachability: confirmed via require('yaml')/from 'yaml' usages in the files above and in tests/unit/workflow-contract.test.mjs and tests/unit/dashboard-site-build.test.mjs.

Validation

• Commands run:
  • Root: npm install yaml@2.9.1 --package-lock-only --registry=https://registry.npmjs.org, then full npm install --ignore-scripts, npx tsc -p .github/cao/tsconfig.json, npm run test:unit
  • dashboard/site: same lockfile-only update, full npm install --ignore-scripts, npm run typecheck, npm test
• Result: typecheck clean in both packages; dashboard/site unit tests: 831/831 tests passed (1 pre-existing failing suite unrelated to this change — node:sqlite bundling in test/unit/data-sqlite-indexeddb.test.js, reproduces identically on unmodified main); root unit tests: same 4–5 pre-existing failures reproduced on unmodified main (activity-cache/workflow-contract sandbox-specific flakiness), none related to yaml.
• Remaining gaps: full npm run check (lint/test:load/check:svg/compile/docs:build) not run in this sandbox pass; CI is the source of truth for those broader checks.

Control Plane

• Correlation ID: 34663110552-219
• Central repo: githubnext/gh-aw-cao
• Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34663110552

• Sensitive surface area: none (no auth, crypto, payment, database, serialization, telemetry, or CI/build-tooling package touched).
• Breaking-change notes: none; patch release, no changelog entries indicating breaking behavior.

Reviewer checklist

• CI passes
• CODEOWNERS or service owners reviewed
• Security-sensitive areas approved, if applicable
• Deployment/canary owner confirms runtime health, if needed

Rollback guidance

• Revert this PR, or pin yaml back to 2.9.0 in both package.json files and regenerate the corresponding package-lock.json files.

Smart-Dependabot-Merge-Candidate: yes

Generated by Dependabot / Release Trains · copilot · auto · 162.7 AIC · ⌖ 13.8 AIC · ⊞ 18.5K · ◷

[cao-githubnext-gh-aw-cao-write]

Duplicate detected. This PR bumps yaml from 2.9.0 to 2.9.1 in the same root and dashboard/site manifests as PR #10419 and #10228 (both still open, same scope, same target version). All three PRs make the functionally identical change; only one should land.

Recommendation: Close this PR in favor of #10419 to avoid redundant review/merge churn. No further dependency-bump action is needed here — the underlying update is already tracked by the other open PR.

Generated by Dependabot / Release Trains · copilot · auto · 103.4 AIC · ⌖ 18.6 AIC · ⊞ 18.5K · ◷

[cao-githubnext-gh-aw-cao-write]

Duplicate dependency bump detected.

This PR (yaml 2.9.0 → 2.9.1) duplicates the same change already open in #10419 (dependabot-agent/yaml-2.9.1-patch-20260912203536), which is the most recent and has clean mergeable state against current main.

Root cause: three separate dependabot-release-train-updater runs each independently proposed the identical yaml patch bump because none of the prior branches had been merged or closed yet, so each run's duplicate-PR search found no matching open PR at scan time.

Recommendation: close this PR and #10228 in favor of #10419, then delete the stale branch dependabot-agent/yaml-2.9.1-patch-20260912010517 (and the other stale dependabot-agent/yaml-* / root-devdeps-patch-* / dashboard-site-devdeps-patch-* / astro-patch-update / copilot-sdk-1.0.13 / playwright-1.63.0-minor / actions-github-security branches — 13 total accumulated across recent runs) to stop future runs from repeatedly re-proposing already-superseded or already-open bumps.

No further action needed from this bot on this PR.

Generated by Dependabot / Release Trains · copilot · auto · 138.9 AIC · ⌖ 11.6 AIC · ⊞ 18.5K · ◷

[cao-githubnext-gh-aw-cao-write]

Duplicate detected: This PR bumps yaml from 2.9.0 to 2.9.1 — the exact same change is already proposed in #10419 and #10228 (both clean/mergeable). This is one of three duplicate PRs produced by earlier runs of the Dependabot Release Train workflow.

Recommendation: Merge or keep only one of #10189 / #10228 / #10419 and close the other two to avoid confusion and duplicate CI churn. #10419 is the most recent and includes full manifest coverage.

No further code change needed here — this is a bookkeeping/triage note only.

Generated by Dependabot / Release Trains · copilot · auto · 60.9 AIC · ⌖ 12.2 AIC · ⊞ 18.5K · ◷

[cao-githubnext-gh-aw-cao-write]

Found three open PRs from this automation that make the identical change (bump yaml 2.9.0 → 2.9.1 in root package.json/package-lock.json and dashboard/site/package.json/package-lock.json):

• [dependabot-agent] Bump yaml to 2.9.1 (patch) #10189 (this PR, oldest, created 2026-09-12)
• [dependabot-agent] Bump yaml from 2.9.0 to 2.9.1 (patch) #10228 (created 2026-09-12, later same day)
• [dependabot-agent] Bump yaml from 2.9.0 to 2.9.1 (patch) #10419 (created 2026-09-12, latest)

All three have identical diffs (same 4 files, same version bump, same risk profile). Recommend keeping this PR (#10189, the oldest/first) and closing #10228 and #10419 as duplicates to reduce review noise. No new dependency work is being opened in this run to avoid adding a fourth duplicate.

Separately: PR #10838 ("Fix undici vulnerabilities via npm override") was closed without merging. The root package.json still has no overrides entry and npm audit on target/ currently reports 5 vulnerabilities (4 moderate, 1 high), all rooted in transitive undici copies pulled in by @actions/artifact, @actions/github, and @github/local-action (dev-only tooling deps). If #10838 was closed as rejected/out-of-scope rather than superseded, please advise; otherwise this remains an open, unaddressed security item and a future run can re-propose the same low-risk overrides pin.

Control Plane

• Correlation ID: 34777400385-1435
• Central repo: githubnext/gh-aw-cao
• Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34777400385

Generated by Dependabot / Release Trains · copilot · auto · 80.1 AIC · ⌖ 8.93 AIC · ⊞ 18.5K · ◷

[cao-githubnext-gh-aw-cao-write]

Root cause: Three open PRs (#10189, #10228, #10419) independently bump yaml 2.9.0 → 2.9.1 in package.json/package-lock.json (root and dashboard/site) with an identical resulting diff. This is the oldest of the three (created 2026-09-12 01:09 UTC) and its diff is byte-identical to #10228.

Status: Safe, reviewable, mergeable_state: clean, marked Smart-Dependabot-Merge-Candidate: yes. No new advisory or regression since creation. Re-verified this run: current main still has yaml at ^2.9.0/resolved 2.9.0 in both lockfiles, so this bump is still needed.

Recommendation: Treat this PR (#10189) as canonical and close #10228 and #10419 as duplicates (see cross-links below) once this one merges, to avoid multiple lockfile-touching bumps of the same dependency landing separately.

Next step: Human reviewer: merge this PR, then close #10228 and #10419 as superseded duplicates.

Generated by Dependabot / Release Trains · copilot · auto · 102.4 AIC · ⌖ 13.7 AIC · ⊞ 18.5K · ◷

[cao-githubnext-gh-aw-cao-write]

Duplicate PR consolidation needed

Three open pull requests — #10189, #10228, and #10419 — all propose the identical patch bump: yaml 2.9.0 → 2.9.1 in both package.json/package-lock.json (root) and dashboard/site/package.json/dashboard/site/package-lock.json. All three are draft, mergeable_state: clean, and content-identical — none supersedes another with new information.

Verified against current state (this run):

• npm view yaml dist-tags → latest: 2.9.1 (unchanged since these PRs opened; no newer release to re-target).
• Target repo (githubnext/gh-aw-cao@main) is still pinned at yaml@2.9.0 in both manifests — the bump has not landed yet.
• No new security advisory affects yaml at either version (routine freshness only).

Safe-output tooling available to this agent cannot close pull requests, so consolidation can't be automated here. Recommended: merge #10189 (earliest, 2026-09-12T01:09:57Z, most thorough validation — typecheck + full unit suites in both root and dashboard/site) and close #10228 and #10419 as duplicates once merged. Opening a fourth PR for the same bump would only add redundant review surface.

Generated by Dependabot / Release Trains · copilot · auto · 68.6 AIC · ⌖ 13.4 AIC · ⊞ 18.5K · ◷

[cao-githubnext-gh-aw-cao-write]

Consolidation note: two duplicate PRs making this identical yaml 2.9.0 → 2.9.1 patch bump were found open — #10419 and #10228. Both have been commented with a recommendation to close in favor of this PR (#10189), since this one has the most thorough validation (typecheck + full unit test suites in both root and dashboard/site).

Before merging this PR: main has moved on since this PR was opened (multiple merges since 2026-09-12, e.g. undici override #10896, actions/github bump #10410). Recommend rebasing/updating this branch against current main and re-running validation prior to merge, since the lockfile diff may no longer apply cleanly.

Generated by Dependabot / Release Trains · copilot · auto · 71.1 AIC · ⌖ 11.1 AIC · ⊞ 18.5K · ◷