fix: bump js-yaml to 4.3.1

[atilafassina]

Summary

Minimal, focused carve-out of the js-yaml portion of #551 (the OSV batch update). Bumps the direct js-yaml declaration in @databricks/appkit and @databricks/shared from 4.2.0 to 4.3.1 and refreshes the lockfile, removing every js-yaml@4.2.0 record (both direct declarations plus the deduped transitives under docusaurus, @eslint/eslintrc, and cosmiconfig).

Diff is 3 files, +15/-15 — no other dependency is touched.

Why 4.3.1

4.3.1 backports two sec updates from js-yaml v5 line.

Impact assessment — negligible

• No API/behavior change for us. The only breaking change across 4.3.0/4.3.1 is the loader-option rename maxMergeSeqLength → maxTotalMergeKeys. AppKit passes no merge/alias options at any call site.
• Advisories not reachable. Both CVEs require parsing untrusted YAML with pathological merge-chains or large !!omap. AppKit's only two yaml.load() call sites parse trusted, source-controlled files at CLI/init time:
  • packages/appkit/src/core/agent/load-agents.ts:320 — markdown agent-file frontmatter
  • packages/shared/src/cli/commands/doctor/bundle.ts:109 — databricks.yml / app.yaml
• This is a defense-in-depth / scanner-clearing bump with no runtime downside.

Scope note

The docs-site-only transitive js-yaml@3.14.2 (via @docusaurus/utils → gray-matter, never shipped in any published package) is intentionally out of scope here — it belongs with a docusaurus toolchain bump rather than a hand-pinned override.

[Copilot]

Pull request overview

Updates the monorepo’s direct js-yaml dependency to a patched release (4.3.1) in the two published packages that declare it, and refreshes the pnpm lockfile to eliminate js-yaml@4.2.0 resolutions (defense-in-depth / advisory cleanup).

Changes:

• Bump js-yaml from 4.2.0 → 4.3.1 in @databricks/appkit and @databricks/shared.
• Regenerate pnpm-lock.yaml so all js-yaml@4.2.0 entries are removed and resolutions point to 4.3.1.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
pnpm-lock.yaml	Updates lockfile resolutions and snapshot entries to js-yaml@4.3.1 and removes js-yaml@4.2.0 records.
packages/shared/package.json	Bumps the direct js-yaml dependency to 4.3.1.
packages/appkit/package.json	Bumps the direct js-yaml dependency to 4.3.1.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

📦 Bundle size report

Compared against bundle-size-baseline.json (main).

@databricks/appkit

npm tarball (packed): 909 KB (-2 B) — gzipped download (dist + bin; excludes release-only docs/NOTICE).

dist	raw	gzip
JS (runtime)	936 KB	325 KB
Type declarations	345 KB	120 KB
Source maps	1.8 MB	610 KB
Other	11 KB	3.7 KB
Total	3.1 MB	1.0 MB

Per-entry composition (own code — deps external (as shipped))

Entry	Initial (gz)	Lazy (gz)	Total (gz)	node_modules (min)	Own code (min)
.	93 KB	2.5 KB	96 KB	external	306 KB
./beta	55 KB	457 B	56 KB	external	166 KB
./testing	17 KB	0 B	17 KB	external	50 KB
./tsdown	520 B	0 B	520 B	external	813 B
./type-generator	21 KB	0 B	21 KB	external	61 KB

Chunks:

Entry	Chunk	Load	Size (gz)
.	index.js	initial	89 KB
.	utils.js	initial	4.0 KB
.	remote-tunnel-manager.js	lazy	2.5 KB
./beta	beta.js	initial	39 KB
./beta	stream-manager.js	initial	5.8 KB
./beta	wide-event-emitter.js	initial	3.2 KB
./beta	databricks.js	initial	3.0 KB
./beta	configuration.js	initial	2.1 KB
./beta	service-context.js	initial	1.3 KB
./beta	client.js	initial	434 B
./beta	client-options.js	initial	220 B
./beta	supervisor-api.js	lazy	192 B
./beta	databricks.js	lazy	142 B
./beta	index.js	lazy	123 B
./testing	index.js	initial	17 KB
./tsdown	index.js	initial	520 B
./type-generator	index.js	initial	21 KB

@databricks/appkit-ui

npm tarball (packed): 348 KB (+2 B) — gzipped download (dist + bin; excludes release-only docs/NOTICE).

dist	raw	gzip
JS (runtime)	394 KB	132 KB
Type declarations	228 KB	83 KB (-1 B)
Source maps	764 KB	252 KB
CSS	16 KB	3.2 KB
Total	1.4 MB	471 KB (-1 B)

Per-entry composition (consumer bundle — deps bundled, peerDeps external)

Entry	Initial (gz)	Lazy (gz)	Total (gz)	node_modules (min)	Own code (min)
./js	5.3 KB	49 KB	55 KB	208 KB	14 KB
./js/beta	20 B	0 B	20 B	0 B	0 B
./react	432 KB	49 KB	481 KB	1.3 MB	177 KB
./react/beta	1.0 KB	0 B	1.0 KB	0 B	1.9 KB

Chunks:

Entry	Chunk	Load	Size (gz)
./js	index.js	initial	5.2 KB
./js	chunk	initial	120 B
./js	apache-arrow	lazy	49 KB
./js/beta	beta.js	initial	20 B
./react	index.js	initial	430 KB
./react	tslib	initial	2.1 KB
./react	apache-arrow	lazy	49 KB
./react/beta	beta.js	initial	1.0 KB

[github-actions]

🤖 AppKit PR bot

🔬 Run evals

Start an eval for this PR from the evals-monitor app: Go to Evals Monitor →

📦 Try this PR's app template

Scaffolds a new app from this PR's SDK build. Run it in any folder (requires the GitHub CLI — gh auth login — and the Databricks CLI):

gh run download 32839033116 -R databricks/appkit -n appkit-template-0.65.0-pr.8178fb2-update-jsyaml-553 -D appkit-pr-553 \
  && unzip -o "appkit-pr-553/appkit-template-0.65.0-pr.8178fb2-update-jsyaml-553.zip" -d "appkit-pr-553" \
  && databricks apps init --template "appkit-pr-553"

The template pins @databricks/appkit and @databricks/appkit-ui to tarballs built from this branch, so the scaffolded app runs against this PR's code.