LTS-4981 / LTS-5094: bump fast-uri + js-yaml security overrides

[MihirR-BS]

Summary

Fixes two open security tickets by extending this repo's existing overrides block in package.json. No new packages added, no dependencies/devDependencies version bumps — only the override floors moved.

LTS-4981 — fast-uri host confusion (GHSA-5jgf-p345-68v8, CVE-2026-75931, CVSS 7.5)

fast-uri skips IDN host canonicalization when resolve() resolves a scheme-relative reference (//host/) against a scheme-bearing base, so a re-parse of the resolved URI can yield a different host than resolve() returned — host-confusion / policy-bypass risk for any code that resolves untrusted references and then makes a decision on the resulting host.

• Vulnerable range (3.x line): >=3.1.3, <3.1.6.
• The existing override was pinned at ^3.1.5 — already inside the vulnerable range. Bumped the floor to ^3.1.6 (patched). Resolves to 3.1.8 in the lockfile.

LTS-5094 — js-yaml maxTotalMergeKeys CPU DoS (GHSA-2883-xcg3-v3hh, CVE-2026-84375, CVSS 7.5)

maxTotalMergeKeys doesn't count empty merge-source mappings, so a small YAML document with a large array of empty mappings merged repeatedly causes O(N*K) CPU work without tripping the configured limit (PoC in the advisory: ~500KB YAML -> ~13s).

• Patched floors: 3.15.2 (3.x) / 4.3.2 (4.x).
• This repo carries two installed js-yaml majors — js-yaml@4 direct/transitive, and js-yaml@3 pulled in transitively via js-yaml-cloudformation-schema (4.x removed safeLoad, so a bare bump would break that 3.x consumer). Kept the version-scoped override split from LTS-4699/4700 and bumped both floors:
  • "js-yaml@3": "^3.15.1" -> "^3.15.2"
  • "js-yaml@4": "^4.3.1" -> "^4.3.2"

Housekeeping while in the overrides block

Converted the remaining exact-pinned override entries (qs, jws, fast-xml-builder, path-expression-matcher) to caret ranges. Exact pins are exactly how the fast-uri override above re-aged into a vulnerable range in the first place (3.1.4 -> pinned again at 3.1.5, itself later vulnerable) — same pattern already applied to ip-address/brace-expansion in prior PRs. Left tmp as an exact pin since it's covered by the separate open tmp+@wdio/cli dependabot PR and out of scope here.

Why this repo gets a real fix, not a dismissal

browserstack-webdriverio-load-testing-sample declares zero runtime dependencies — every entry, including both vulnerable packages, is a devDependency. This is nonetheless a public, customer-facing repo that customers clone and npm install directly, so the team's standing call (consistent with ~10 prior security PRs on this repo, e.g. LTS-4657, LTS-4699/4700, LTS-4750) is to still ship the overrides fix rather than dismiss the advisory as dev-only.

Verification

• npm install --package-lock-only — lockfile diff is scoped to exactly the 3 changed package entries (fast-uri, js-yaml top-level, js-yaml under js-yaml-cloudformation-schema) plus package.json; no incidental peer-marker churn.
• npm ci from a clean install (867 packages, no node_modules carried over).
• npm ls fast-uri --all / npm ls js-yaml --all against the real installed tree:
  • fast-uri@3.1.8 overridden (single copy, via browserstack-node-sdk -> table -> ajv)
  • js-yaml@4.3.2 overridden/deduped for every 4.x consumer, js-yaml@3.15.2 overridden for js-yaml-cloudformation-schema — confirms the 3.x consumer was not force-upgraded onto 4.x.
• npm audit no longer flags js-yaml or fast-uri.
• Integrity hashes for fast-uri@3.1.8, js-yaml@4.3.2, js-yaml@3.15.2 cross-checked against npm view <pkg>@<ver> dist.integrity.
• .npmrc's min-release-age=7 cooldown: all three target versions published 2026-08-23/2026-08-26, well clear of the 7-day gate as of today.

Note on existing dependabot PR #4 ("Bump js-yaml")

PR #4 (dependabot/npm_and_yarn/multi-75e6bc5210, opened 2025-11-18) predates the LTS-4699/4700 version-scoped-override fix and bumps the two installed copies only to js-yaml@4.1.1 / js-yaml-cloudformation-schema's js-yaml@3.14.2 — both still inside LTS-5094's vulnerable ranges (<4.3.2 / <3.15.2) even if merged. It's superseded by this PR; not force-closing it here, leaving it for dependabot to auto-close (or for a maintainer to close) once this merges.

Out of scope

Other open dependabot PRs (lodash, glob, qs, tmp+@wdio/cli, ws+@wdio/*, jws) are untouched.

Refs: LTS-4981, LTS-5094

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited), Workspace UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 28b6abb4-9d95-4788-813b-7e253ffcd71a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}