fix(deps): keep js-yaml on 4.x so the release job can load it

[prisis]

The release job on main dies before publishing anything:

SyntaxError: The requested module 'js-yaml' does not provide an export named 'default'

Cause

@anolilab/multi-semantic-release does import yaml from "js-yaml" in its bundled topo module. js-yaml 5 dropped the default export from its ESM build, so the import throws at load time.

Verified directly rather than inferred:

$ node --input-type=module -e "import y from '…/js-yaml@4.3.1/…/dist/js-yaml.mjs'; console.log(typeof y)"
object

$ same against 5.3.0
SyntaxError: … does not provide an export named 'default'

pnpm exec multi-semantic-release --help exits 0 on this branch; on main it is the command that fails.

How it got in

#1117 raised both js-yaml overrides to ^5.3.0. The js-yaml@>=4.0.0 <4.3.0 entry has this comment sitting immediately above it:

# Stay on 4.x: js-yaml 5.x is ESM-only with no default export and breaks
# multi-semantic-release's `import ... from "js-yaml"`. ^4.3.0 still patches GHSA-52cp-r559-cp3m.
js-yaml@>=4.0.0 <4.3.0: "^4.3.1"

I merged Renovate's bump straight past it. The failure mode was already documented in the file, one line above the change.

Fix

Restore both ranges to their previous values, and add the same constraint to the 3.x entry so the next update does not silently repeat it:

Range	Was (#1117)	Now
js-yaml@>=3.0.0 <3.15.1	^5.3.0	^3.15.1
js-yaml@>=4.0.0 <4.3.0	^5.3.0	^4.3.1

Both still patch the advisories the overrides exist for — pnpm audit --audit-level=moderate reports no known vulnerabilities.

Verification

• pnpm exec multi-semantic-release --help — exit 0 (this is what fails on main)
• pnpm install --frozen-lockfile — exit 0
• audit clean, build 8/8, lint 6/6, tests 4/4 projects

Follow-up worth considering

This is the second ESM-only major to slip through a dependency update today; the nanoid one was caught before merging only because it was checked by hand. A Renovate rule that holds majors for packages consumed via a default import, or simply treating an adjacent "stay on Nx" comment as blocking, would catch the next one.

🤖 Generated with Claude Code

https://claude.ai/code/session_014FP75FgnREe4L45kZtsa9a

Summary by CodeRabbit

• Bug Fixes
  • Updated security overrides for js-yaml dependencies.
  • Preserved compatibility for applications using both 3.x and 4.x versions.

[github-actions]

Thank you for following the naming conventions! 🙏

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1ef4b855-9ac5-464c-bc61-9254e2e64c7f

📥 Commits

Reviewing files that changed from the base of the PR and between 8236b3e and 59b66e1.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

 _______________________________________________________________
< e/acc/def/det: Effective accelerationism of defect detection. >
 ---------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches 💡 1

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch fix/js-yaml-v5-breaks-release

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/js-yaml-v5-breaks-release

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}