[dependabot-agent] Bump yaml from 2.9.0 to 2.9.1

[cao-githubnext-gh-aw-cao-write]

What changed

• Package/ecosystem: npm (root gh-aw-cao package)
• Manifest(s): package.json, package-lock.json
• Old version: yaml@2.9.0
• New version: yaml@2.9.1
• Update type: patch

Why now

• Routine freshness: yaml was one minor patch behind. npm audit reports 0 vulnerabilities at 2.9.0, and both known GHSA advisories for yaml (GHSA-48c2-rrv3-qjmp / CVE-2026-33532 stack-overflow-via-deep-nesting, and GHSA-f9xv-q969-pqx4 / CVE-2023-2251) were already patched at 2.8.3 and 2.2.2 respectively — well before 2.9.0. This is not a security-driven update.
• yaml is a direct root dependency imported across test files (tests/unit/*.test.mjs), dashboard/site/src/validator.js, scripts/package-lifecycle-matrix.mjs, and docs/lib/catalog.ts, so keeping it current avoids drift.

Risk assessment

• Runtime/dev/build/CI scope: build/test tooling (YAML parsing for tests, docs catalog, dashboard validator) — not a production hot-path payment/auth/crypto dependency.
• Direct/transitive: direct dependency.
• Reachability: actively imported (import { parse } from "yaml" / parseAllDocuments) in 6+ files; confirmed via repository grep.

Validation

• Commands run: npm install yaml@2.9.1, npm run test:unit, manual smoke test of parse()/parseAllDocuments via node -e.
• Result: unit test suite shows 4 failures with the bump vs 5 failures on unmodified main (same commands, same sandbox) — confirmed via git stash/git stash pop A/B comparison. The failing tests are pre-existing, environment-dependent (network/credential-gated) and unrelated to this change; none reference yaml parsing. yaml.parse/parseAllDocuments smoke-tested successfully.
• Remaining gaps: full npm run check (lint/typecheck/compile/docs build) not run in this pass; recommend CI confirms green before merge.

Control Plane

• Correlation ID: 34925026002-294
• Central repo: githubnext/gh-aw-cao
• Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34925026002

Toolchain: Node v22.23.2 (as preinstalled in sandbox), npm resolving via existing package-lock.json mirror configuration (no toolchain manifest change needed).
Registry preflight: npm view yaml@2.9.1 resolved successfully from the public npm registry; no private registry involved.
Breaking changes/migrations: none — patch-level release, no documented breaking API changes.
Risk: low
Confidence: high
Rollback: revert this commit (or pin yaml back to 2.9.0 in package.json and regenerate package-lock.json with npm install yaml@2.9.0).

Smart-Dependabot-Merge-Candidate: yes

Reviewer checklist

• CI passes
• CODEOWNERS or service owners reviewed
• Security-sensitive areas approved, if applicable
• Deployment/canary owner confirms runtime health, if needed

Rollback guidance

• Revert this PR, or pin yaml back to 2.9.0 in package.json and run npm install yaml@2.9.0 to regenerate package-lock.json.
• Revert package.json and package-lock.json together; they must stay in sync.

Generated by Dependabot / Release Trains · copilot · auto · 131.6 AIC · ⌖ 14.5 AIC · ⊞ 18.5K · ◷

[github-actions]

Dashboard view assessment

5/6 selected views passed the informational assessment. The DOM budget is 6000 nodes per loaded view.
Assessment blocker: browser.newPage: Test ended. Browser logs: /usr/bin/chromium --disable-field-trial-config --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-back-forward-cache --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-component-update --no-default-browser-check --disable-default-apps --disable-dev-shm-usage --disable-edgeupdater --disable-extensions -

View	Result	DOM nodes	Findings
operations	passed	524	None
readiness	passed	686	None
github-api	passed	583	None
safe-output-items	passed	583	None
cost	passed	515	None
firewall	failed	unknown	1 browser error(s)
View the workflow run.

[cao-githubnext-gh-aw-cao-write]

Duplicate detected. This PR duplicates three other open dependabot-agent PRs that already propose the identical yaml 2.9.0 → 2.9.1 patch bump: #10189, #10228, and #10419.

• Root cause: no safe-output primitive available to this worker can close or merge a duplicate PR, so each release-train run that re-derives this same low-risk patch opens a new one instead of reusing an existing thread.
• Recommendation for a human reviewer: keep the PR with the broadest manifest coverage and pick one canonical PR, then close the others as duplicates. Of the four, [dependabot-agent] Bump yaml from 2.9.0 to 2.9.1 (patch) #10419 covers both root and dashboard/site manifests (4 files changed); [dependabot-agent] Bump yaml to 2.9.1 (patch) #10189, [dependabot-agent] Bump yaml from 2.9.0 to 2.9.1 (patch) #10228, and this PR ([dependabot-agent] Bump yaml from 2.9.0 to 2.9.1 #11463) only touch the root manifest (2 files changed). Merging [dependabot-agent] Bump yaml from 2.9.0 to 2.9.1 (patch) #10419 and closing the rest is the smallest reviewable path.
• No new evidence changes the underlying analysis already documented across [dependabot-agent] Bump yaml to 2.9.1 (patch) #10189/[dependabot-agent] Bump yaml from 2.9.0 to 2.9.1 (patch) #10228/[dependabot-agent] Bump yaml from 2.9.0 to 2.9.1 (patch) #10419: 0 npm audit findings, patch-level/no breaking changes, low risk, high confidence.

No further action needed from the automation side until a maintainer consolidates these.

Generated by Dependabot / Release Trains · copilot · auto · 76.1 AIC · ⌖ 12.1 AIC · ⊞ 18.5K · ◷