Update js-yaml from ~4.1.0 to ~4.2.0 to address GHSA-h67p-54hq-rp68

Author: Copilot

apps/api-documenter/package.json

@@ -49,7 +49,7 @@
     "@rushstack/node-core-library": "workspace:*",
     "@rushstack/terminal": "workspace:*",
     "@rushstack/ts-command-line": "workspace:*",
-    "js-yaml": "~4.1.0",
+    "js-yaml": "~4.2.0",
     "resolve": "~1.22.1"
   },
   "devDependencies": {

apps/lockfile-explorer/package.json

@@ -68,7 +68,7 @@
     "@rushstack/ts-command-line": "workspace:*",
     "cors": "~2.8.5",
     "express": "4.21.1",
-    "js-yaml": "~4.1.0",
+    "js-yaml": "~4.2.0",
     "semver": "~7.7.4"
   },
   "exports": {

common/changes/@microsoft/rush/update-js-yaml-security_2026-06-24-18-22.json

@@ -0,0 +1,11 @@
+{
+  "changes": [
+    {
+      "comment": "Update js-yaml dependency to ~4.2.0 to address security advisory GHSA-h67p-54hq-rp68 (poor performance characteristics with certain input)",
+      "type": "none",
+      "packageName": "@microsoft/rush"
+    }
+  ],
+  "packageName": "@microsoft/rush",
+  "email": "copilot@microsoft.com"
+}

common/config/subspaces/build-tests-subspace/pnpm-lock.yaml

@@ -1,6 +1,6 @@
 // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush.
 {
-  "pnpmShrinkwrapHash": "68f19a15bc2ad51338ac42af387887d9e67a2e54",
+  "pnpmShrinkwrapHash": "11f7d19cb240fcab860492fd9f076698c8e58cf7",
   "preferredVersionsHash": "550b4cee0bef4e97db6c6aad726df5149d20e7d9",
-  "packageJsonInjectedDependenciesHash": "53d4f8e2a003af60173d4a21283b23fc14eac530"
+  "packageJsonInjectedDependenciesHash": "0b6a3303d9383c239c25ae457d2beaddbf8e51c4"
 }

common/config/subspaces/build-tests-subspace/repo-state.json

@@ -1,5 +1,5 @@
 // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush.
 {
-  "pnpmShrinkwrapHash": "265008d6cb4e700aad22dea81810ed1f363cbf31",
+  "pnpmShrinkwrapHash": "fcf566944b7e4dceb172fd33074f21920a90a732",
   "preferredVersionsHash": "029c99bd6e65c5e1f25e2848340509811ff9753c"
 }

common/config/subspaces/default/pnpm-lock.yaml

@@ -68,7 +68,7 @@
     "@inquirer/input": "~5.0.11",
     "@inquirer/search": "~4.1.7",
     "@inquirer/select": "~5.1.3",
-    "js-yaml": "~4.1.0",
+    "js-yaml": "~4.2.0",
     "npm-package-arg": "~6.1.0",
     "object-hash": "3.0.0",
     "pnpm-sync-lib": "0.3.3",

common/config/subspaces/default/repo-state.json

@@ -36,7 +36,7 @@
     "@microsoft/api-extractor-model": "workspace:*",
     "@microsoft/tsdoc": "~0.16.0",
     "@rushstack/node-core-library": "workspace:*",
-    "js-yaml": "~4.1.0"
+    "js-yaml": "~4.2.0"
   },
   "devDependencies": {
     "@rushstack/heft": "workspace:*",