chore(deps): bump the npm-security group across 2 directories with 2 updates

[dependabot]

Bumps the npm-security group with 1 update in the /vscode/prompty/packages/core directory: js-yaml.
Bumps the npm-security group with 1 update in the /web directory: devalue.

Updates js-yaml from 3.15.1 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

Commits

• 5c45bd6 3.15.2 released
• 5a708f9 dist rebuild
• 3485bc0 Backport merge limits from v5.4.1
• f34812f Update .gitignore
• See full diff in compare view

Updates devalue from 5.9.0 to 5.9.4

Release notes

Sourced from devalue's releases.

v5.9.4

Patch Changes

• 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Patch Changes

• 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
• 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
• dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
• 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
• 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
• 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
• 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

v5.9.2

Patch Changes

• 8b2a456: fix: reject out-of-bounds indices

v5.9.1

Patch Changes

• 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
• 686e379: fix: emit valid JS for Node Buffer in uneval
• 376b65c: fix: preserve -0 in float typed arrays in uneval

Changelog

Sourced from devalue's changelog.

5.9.4

Patch Changes

• 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

5.9.3

Patch Changes

• 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
• 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
• dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
• 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
• 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
• 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
• 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

5.9.2

Patch Changes

• 8b2a456: fix: reject out-of-bounds indices

5.9.1

Patch Changes

• 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
• 686e379: fix: emit valid JS for Node Buffer in uneval
• 376b65c: fix: preserve -0 in float typed arrays in uneval

Commits

• 434358a Version Packages (#202)
• 067b125 perf: annotate module-level Object.freeze calls as pure (#200)
• 53cd3db Version Packages (#201)
• 46dc877 Merge commit from fork
• 84f6f67 Merge commit from fork
• 6861dbb Merge commit from fork
• 8f8d78e Merge commit from fork
• dae8153 Merge commit from fork
• 9ec5130 Merge commit from fork
• 8ade61d chore: fix bench:compare script (#198)
• Additional commits viewable in compare view