chore(security): patch 4 Dependabot alerts

[PMerlet]

👋 First-level support: see Handling automated security PRs for how to triage and merge this PR.

Summary

4 fixed, 0 ignored, 2 deferred, 0 resolutions added, 0 resolutions removed. | label: 🔒 security applied

All fixes are lockfile-only refreshes: every patched version already satisfies the semver range declared by the parent packages, so no package.json change and no new resolutions entry was needed.

Fixed

Done	Alert	Package	Ecosystem	From → To	Severity	What was bumped
- [ ]	#88	js-yaml	npm	4.1.1 → 4.3.0	medium	transitive (semantic-release > cosmiconfig, @commitlint/cli > @commitlint/load > cosmiconfig) — in-range lockfile refresh of js-yaml@^4.1.0
- [ ]	#87	sigstore	npm	4.1.0 → 4.1.1	high	transitive (semantic-release > @semantic-release/npm > npm > libnpmpublish) — in-range lockfile refresh of sigstore@^4.0.0
- [ ]	#86	@sigstore/verify	npm	3.1.0 → 3.1.1	medium	transitive (via sigstore) — in-range lockfile refresh of @sigstore/verify@^3.1.0 → ^3.1.1
- [ ]	#85	@sigstore/core	npm	3.2.0 → 3.2.1	medium	transitive (via sigstore / @sigstore/verify / @sigstore/sign) — in-range lockfile refresh of @sigstore/core@^3.2.0 → ^3.2.1

Note: the js-yaml bump to 4.3.0 also incidentally covers deferred alert #90 (patched in 4.3.0) — GitHub should auto-close it on merge.

Ignored

None.

Deferred

Opened less than 7 days ago — left for the next run:

Alert	Package	Severity	Opened
#90	js-yaml	high	2026-07-21
#89	brace-expansion	high	2026-07-21

Resolutions added

None.

Resolutions removed

None. The existing root entry "semantic-release-slack-bot/**/micromatch": "^4.0.8" was audited: it is neither stale (micromatch is still in the tree) nor redundant (removing it makes semantic-release-slack-bot's exact pin micromatch@4.0.2 win again, which is < 4.0.8) — so it was kept.

Risks

All four packages are devDependencies of the release tooling (semantic-release, @commitlint/cli) — nothing here ships with the Ruby gem.

• js-yaml 4.1.1 → 4.3.0 (two minors): 4.2.0 adds bundled TypeScript types and fixes the quadratic merge-key DoS; 4.3.0 hardens merge-key chain handling. No breaking API changes in the 4.x line; consumed only by cosmiconfig for config parsing.
• sigstore 4.1.0 → 4.1.1 / @sigstore/verify 3.1.0 → 3.1.1 / @sigstore/core 3.2.0 → 3.2.1 (patches): fix verification-constraint enforcement (certificateOIDs, DSSE payloadType, data-authenticity checks). Behavior change is strictly "verification gets stricter"; used only by npm publish provenance inside semantic-release.

No behavior change expected beyond the patched vulnerabilities.

Manual testing

Covered by CI.

Validation

✅ CI green

Note: the first CI attempt failed on one flaky timing test unrelated to this diff (forest_admin_datasource_toolkit Ruby 4.0, times_spec.rb:49 — 1-second boundary race in BeforeXHoursAgo). Failed jobs were re-run once per policy and passed.

[forest-bot]

🎉 This PR is included in version 1.36.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀