fix(deps): align aegis js-yaml manifest pin with the override floor

[chapati23]

The Problem

• aegis/package.json still declares js-yaml: 4.2.0 exact while the workspace override floor forces 4.3.0 — the pin is stale, and if the override is ever pruned, a fresh install silently downgrades aegis back to the vulnerable version.

The Solution

• Bump the manifest pin to 4.3.0 so it matches the resolved version. Lockfile needs no change: pnpm records the overridden specifier, so this is a one-line manifest alignment. (Residual carried over from the superseded PR fix(deps): raise security override floors for the 2026-07 advisory batch #1380; everything else in that PR landed via fix(deps): refresh advisory override floors #1381.)

🤖 Generated with Claude Code

https://claude.ai/code/session_01CiUreX7DKuRKiHQT6HkY4z

---

Note

Low Risk
Single dependency version pin bump with no application or lockfile changes; security-relevant only in that it documents the patched floor.

Overview
Updates the aegis direct dependency on js-yaml from 4.2.0 to 4.3.0 so the manifest matches the workspace override minimum and what installs already resolve.

This is manifest-only alignment (no lockfile or runtime code changes); it avoids a future install path where a removed override could pull 4.2.0 back in for aegis.

^{Reviewed by Cursor Bugbot for commit a298ef4. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
monitoring-dashboard	Ignored	Preview	Jul 21, 2026 12:33pm

[claude]

Claude finished @chapati23's task in 50s —— View job

---

Review complete

• Gather context (PR diff, package.json, pnpm overrides)
• Review the change for correctness
• Check lockfile / override alignment
• Post final review

Verdict: LGTM ✅

Findings

1. [P3] None — the change is correct and minimal. aegis/package.json bumps js-yaml from 4.2.0 → 4.3.0, matching the workspace override floor "js-yaml@>=4.0.0 <4.3.0": 4.3.0 in pnpm-workspace.yaml:83. Confirmed pnpm-lock.yaml already records specifier: 4.3.0 / version: 4.3.0 for the aegis package (lines 140–142), so leaving the lockfile untouched is correct — no pnpm install was needed.

Verification performed

• Diffed aegis/package.json against origin/main — only the single-line pin bump, as described.
• Confirmed the override that motivates this fix: pnpm-workspace.yaml:83 (js-yaml@>=4.0.0 <4.3.0 → 4.3.0), part of the advisory override floors refreshed in fix(deps): refresh advisory override floors #1381.
• Confirmed pnpm-lock.yaml's aegis dependency block already resolves js-yaml to 4.3.0, so the manifest was previously silently relying on the override — this PR removes that latent drift risk (manifest now matches what's actually installed, so pruning the override later won't cause a silent downgrade).
• No other files changed; scope matches the stated PR description exactly.

Straightforward, correctly-scoped supply-chain hygiene fix. Nothing to flag.