Update js-yaml from ~4.1.0 to ~4.2.0 to address GHSA-h67p-54hq-rp68

Co-authored-by: dmichon-msft <26827560+dmichon-msft@users.noreply.github.com>

Author: Copilot

apps/api-documenter/package.json

@@ -52,7 +52,7 @@
     "@rushstack/node-core-library": "workspace:*",
     "@rushstack/terminal": "workspace:*",
     "@rushstack/ts-command-line": "workspace:*",
-    "js-yaml": "~4.1.0",
+    "js-yaml": "~4.2.0",
     "resolve": "~1.22.1"
   },
   "devDependencies": {

apps/lockfile-explorer/package.json

@@ -71,7 +71,7 @@
     "@rushstack/ts-command-line": "workspace:*",
     "cors": "~2.8.5",
     "express": "4.21.1",
-    "js-yaml": "~4.1.0",
+    "js-yaml": "~4.2.0",
     "semver": "~7.7.4"
   },
   "exports": {

common/changes/@microsoft/rush/update-js-yaml-security_2026-06-24-18-22.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "comment": "Update js-yaml dependency to ~4.2.0 to address security advisory GHSA-h67p-54hq-rp68 (poor performance characteristics with certain input)",
+      "type": "none",
+      "packageName": "@microsoft/rush"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}

libraries/rush-lib/package.json

@@ -68,7 +68,7 @@
     "@inquirer/input": "~5.0.11",
     "@inquirer/search": "~4.1.7",
     "@inquirer/select": "~5.1.3",
-    "js-yaml": "~4.1.0",
+    "js-yaml": "~4.2.0",
     "npm-package-arg": "~6.1.0",
     "object-hash": "3.0.0",
     "pnpm-sync-lib": "0.3.4",

repo-scripts/doc-plugin-rush-stack/package.json

@@ -36,7 +36,7 @@
     "@microsoft/api-extractor-model": "workspace:*",
     "@microsoft/tsdoc": "~0.16.0",
     "@rushstack/node-core-library": "workspace:*",
-    "js-yaml": "~4.1.0"
+    "js-yaml": "~4.2.0"
   },
   "devDependencies": {
     "@rushstack/heft": "workspace:*",