Bump js-yaml from 4.3.1 to 4.3.2 in /dotnet/samples/Demos/ProcessWithCloudEvents/ProcessWithCloudEvents.Client - #14405
Conversation
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.1 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
🟢 Approval recommended
The change is a straightforward patch-level dependency update reflected consistently across the project’s lockfiles.
Pull request overview
Updates the JS dependency lockfiles for the ProcessWithCloudEvents.Client sample to pull in js-yaml 4.3.2 (from 4.3.1), aligning the resolved package and integrity hashes with the new patch release.
Changes:
- Bump
js-yamlfrom4.3.1to4.3.2inyarn.lock. - Bump
js-yamlfrom4.3.1to4.3.2inpackage-lock.json(including updatedresolved/integrity). - Update transitive lockfile entries caused by the lockfile regeneration.
File summaries
| File | Description |
|---|---|
| dotnet/samples/Demos/ProcessWithCloudEvents/ProcessWithCloudEvents.Client/yarn.lock | Updates the Yarn lock entry for js-yaml to 4.3.2 and refreshes related resolved metadata. |
| dotnet/samples/Demos/ProcessWithCloudEvents/ProcessWithCloudEvents.Client/package-lock.json | Updates the npm lock entry for js-yaml to 4.3.2 and adjusts dependent lock sections accordingly. |
Review details
Copilot wasn't able to review any files in this pull request.
Files not reviewed (1)
- dotnet/samples/Demos/ProcessWithCloudEvents/ProcessWithCloudEvents.Client/package-lock.json: Generated file
- Files reviewed: 0/2 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: No findings
Scope: full PR (1 commit(s)): 29079dca8d21
Model: gpt-5.6-sol-fast
Overview
This lockfile-only change consistently updates the indirect, development-only js-yaml dependency to 4.3.2 in both package managers. The unchanged manifest, ESLint-only dependency path, matching artifact integrity, and compatible lockfile normalization constrain the change from affecting the sample's runtime or public contracts. No Critical, High, or Medium defect was established.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.
Bumps js-yaml from 4.3.1 to 4.3.2.
Changelog
Sourced from js-yaml's changelog.
Commits
79ca68d4.3.2 releasedd90b661Backport merge limits from v5.4.1Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.