chore(deps): bump js-yaml to 4.3.1 in sim-cli and drop the aged-out release-age waivers

js-yaml < 4.3.1 has quadratic CPU consumption in !!omap resolution
(GHSA-5p4m-2wfm-xmqj / CVE-2026-59870). sim-cli builds with
--packages=bundle, so its dev-scoped js-yaml is bundled into the
published CLI. 4.3.1 is already what apps/sim pins, so this collapses
sim-cli onto the hoisted copy.

The minimumReleaseAge waivers for js-yaml and mermaid were temporary
and have both aged past the 7-day window; leaving them behind would
disable the supply-chain gate for those packages indefinitely.

Author: waleedlatif1

bun.lock

@@ -4,17 +4,13 @@ exact = true
 # (blocks freshly published, potentially compromised releases).
 minimumReleaseAge = 604800
 # @typescript/native-preview stays excluded permanently: it only publishes nightly
-# dev builds, so every version is structurally younger than any age gate.
-# mermaid 11.16.1 (published 2026-08-04) clears five open Dependabot advisories that
-# 11.15.0 carries: architecture-diagram and config-API prototype pollution, radar and
-# XY-chart DoS, and CSS injection into siblings of the diagram. It is inside the 7-day
-# window and cannot be installed without an exception; it ages out on 2026-08-11 — drop
-# the entry then, and re-date this note on any further bump rather than deleting the entry
-# early, because removing it while the pinned version is still inside the window blocks the
-# bump outright. js-yaml 4.3.1 (published 2026-07-31) carries the CVE-2026-59870 !!omap
-# quadratic-CPU fix, which was never backported to the 4.3.0 line; it ages out on 2026-08-07,
-# so that entry can go on the next touch of this file.
-minimumReleaseAgeExcludes = ["@typescript/native-preview", "mermaid", "js-yaml"]
+# dev builds, so every version is structurally younger than any age gate. Every other
+# entry here is a temporary waiver for one pinned version that is still inside the
+# window, and must be dropped once that version ages out — an exclusion left behind
+# disables the gate for that package forever. Both prior waivers have aged out:
+# mermaid 11.16.1 (published 2026-08-04) on 2026-08-11, and js-yaml 4.3.1
+# (published 2026-07-31) on 2026-08-07.
+minimumReleaseAgeExcludes = ["@typescript/native-preview"]
 
 [run]
 env = { NEXT_PUBLIC_APP_URL = "http://localhost:3000" }

bunfig.toml

@@ -53,7 +53,7 @@
     "@xterm/headless": "6.0.0",
     "chalk": "5.6.2",
     "commander": "^11.1.0",
-    "js-yaml": "4.3.0",
+    "js-yaml": "4.3.1",
     "typescript": "^7.0.2",
     "vitest": "^4.1.0"
   }