Fix js-yaml security advisories

Raise the shared js-yaml dependency to ~4.3.1 and refresh Rush dependency metadata.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: JacksonWeber

apps/api-documenter/package.json

@@ -52,7 +52,7 @@
     "@rushstack/node-core-library": "workspace:*",
     "@rushstack/terminal": "workspace:*",
     "@rushstack/ts-command-line": "workspace:*",
-    "js-yaml": "~4.1.0",
+    "js-yaml": "~4.3.1",
     "resolve": "~1.22.1"
   },
   "devDependencies": {

apps/lockfile-explorer/package.json

@@ -71,7 +71,7 @@
     "@rushstack/ts-command-line": "workspace:*",
     "cors": "~2.8.5",
     "express": "4.21.1",
-    "js-yaml": "~4.1.0",
+    "js-yaml": "~4.3.1",
     "semver": "~7.7.4"
   },
   "exports": {

common/changes/@microsoft/rush/fix-js-yaml-security_2026-08-20-22-19.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "Update js-yaml to ~4.3.1 to address CVE-2026-59869 and GHSA-5p4m-2wfm-xmqj.",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}

common/config/subspaces/build-tests-subspace/pnpm-lock.yaml

@@ -1,6 +1,6 @@
 // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush.
 {
-  "pnpmShrinkwrapHash": "4e7dc2a53df7dd2ee77e903f8f67c29f817ecd81",
+  "pnpmShrinkwrapHash": "3058be418b277acccf1aa815413c6245c71cbbde",
   "preferredVersionsHash": "550b4cee0bef4e97db6c6aad726df5149d20e7d9",
   "packageJsonInjectedDependenciesHash": "dacc324b7b6d9e35baf57460cae419ef162589d6"
 }

common/config/subspaces/build-tests-subspace/repo-state.json

@@ -1,5 +1,5 @@
 // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush.
 {
-  "pnpmShrinkwrapHash": "3a02f48687fcafbf4ecd96d74677d760f95a2e89",
+  "pnpmShrinkwrapHash": "a9da538929392ee31e330a8381ad3b1b9e7bc787",
   "preferredVersionsHash": "029c99bd6e65c5e1f25e2848340509811ff9753c"
 }

common/config/subspaces/default/pnpm-lock.yaml

@@ -68,7 +68,7 @@
     "@inquirer/input": "~5.0.11",
     "@inquirer/search": "~4.1.7",
     "@inquirer/select": "~5.1.3",
-    "js-yaml": "~4.1.0",
+    "js-yaml": "~4.3.1",
     "npm-package-arg": "~6.1.0",
     "object-hash": "3.0.0",
     "pnpm-sync-lib": "0.3.4",

common/config/subspaces/default/repo-state.json

@@ -36,7 +36,7 @@
     "@microsoft/api-extractor-model": "workspace:*",
     "@microsoft/tsdoc": "~0.16.0",
     "@rushstack/node-core-library": "workspace:*",
-    "js-yaml": "~4.1.0"
+    "js-yaml": "~4.3.1"
   },
   "devDependencies": {
     "@rushstack/heft": "workspace:*",