From b0c9d0c15a55c7fbbef00f5c0b4db50f5d433970 Mon Sep 17 00:00:00 2001
From: Deirdre Malone <dmalone@redhat.com>
Date: Thu, 6 Aug 2026 15:49:38 +0100
Subject: [PATCH] [release-4.20] CVE-2026-59869 bump js-yaml

---
 frontend/package.json |  2 +-
 frontend/yarn.lock    | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/frontend/package.json b/frontend/package.json
index ed9b0bf2e77..70df9b8b6c1 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -181,7 +181,7 @@
     "immutable": "^3.8.3",
     "istextorbinary": "^9.5.0",
     "js-base64": "^3.7.7",
-    "js-yaml": "^3.13.1",
+    "js-yaml": "^3.15.0",
     "json-schema": "^0.3.0",
     "jsonpath-plus": "^10.3.0",
     "lodash-es": "^4.18.1",
diff --git a/frontend/yarn.lock b/frontend/yarn.lock
index 6ff3be3d1e7..be821bca940 100644
--- a/frontend/yarn.lock
+++ b/frontend/yarn.lock
@@ -15497,15 +15497,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"js-yaml@npm:^3.10.0, js-yaml@npm:^3.13.1, js-yaml@npm:^3.7.0, js-yaml@npm:^3.9.0":
-  version: 3.14.0
-  resolution: "js-yaml@npm:3.14.0"
+"js-yaml@npm:^3.10.0, js-yaml@npm:^3.13.1, js-yaml@npm:^3.15.0, js-yaml@npm:^3.7.0, js-yaml@npm:^3.9.0":
+  version: 3.15.1
+  resolution: "js-yaml@npm:3.15.1"
   dependencies:
     argparse: "npm:^1.0.7"
     esprima: "npm:^4.0.0"
   bin:
     js-yaml: bin/js-yaml.js
-  checksum: 10c0/9b21ab19f03aae734c83e5c8a3d5e6f80bab5ce0e24bdbb186e531fb0887ff0034affd96ae3eed993c33e33bc606a6b78389207b853df97094393804d6c37184
+  checksum: 10c0/6c693b8c59ffe12021df3b36994b090df19d920826dd810baab81652b40861e1974509dd11fe92225ab4c00cc14de053300c94db015c2c0e211edea39b118737
   languageName: node
   linkType: hard
 
@@ -18513,7 +18513,7 @@ __metadata:
     jest-resolve: "npm:^26.4.0"
     jest-transform-graphql: "npm:^2.1.0"
     js-base64: "npm:^3.7.7"
-    js-yaml: "npm:^3.13.1"
+    js-yaml: "npm:^3.15.0"
     json-schema: "npm:^0.3.0"
     jsonpath-plus: "npm:^10.3.0"
     lint-staged: "npm:^10.2.2"