chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Bumped js-yaml to 4.3.1 in playground-app to resolve a high-severity quadratic CPU consumption vulnerability (alert fix(deps): update module google.golang.org/grpc to v1.52.0 - autoclosed #275)

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#275	js-yaml	high	Bumped to 4.3.1 via package.json/package-lock.json

Unresolvable (no compatible patched version)

The following alerts affect github.com/docker/docker in test/integration/go.mod, pulled in transitively via testcontainers-go, docker/buildx, and docker/compose/v5. Upstream moved the fixed releases (v29.x+) to a new module path (github.com/moby/moby/v2), which is not yet consumed by these dependency chains in a compatible way. Attempting to force the upgrade cascades into an unrelated, very large dependency tree (containerd v2, sigstore, vault, opa, etc.) and a Go toolchain bump, which is too invasive/risky for a routine security fix. No safe non-breaking patched version is currently available.

Alert	Package	Severity	Status
#152	github.com/docker/docker	high	No compatible module version available (patched release under new module path)
#151	github.com/docker/docker	medium	No patched version reported for the affected code path
#184	github.com/docker/docker	high	No patched version reported for the affected code path
#185	github.com/docker/docker	medium	No patched version reported for the affected code path
#186	github.com/docker/docker	high	No patched version reported for the affected code path

[netlify]

✅ Deploy Preview for polite-licorice-3db33c canceled.

Name	Link
🔨 Latest commit	b15633f
🔍 Latest deploy log	https://app.netlify.com/projects/polite-licorice-3db33c/deploys/6a84517c62730f000822c00a

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 223a569a-d904-4dec-ba44-de59f513d201

📥 Commits

Reviewing files that changed from the base of the PR and between e045237 and fd5e02f.

⛔ Files ignored due to path filters (1)

• playground-app/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• playground-app/package.json

Included review availability: Your plan includes up to 4 reviews per rolling hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The playground application updates its js-yaml runtime dependency constraint from ^4.2.0 to ^4.3.1.

Changes

Playground dependency update

Layer / File(s)	Summary
Update js-yaml constraint playground-app/package.json	The runtime dependency constraint changes from ^4.2.0 to ^4.3.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to fd5e0

This PR makes a localized dependency update to address a security alert, with no actionable merge-blocking risk remaining beyond normal checks and review.

Possibly related PRs

• open-feature/flagd#1980: Updates the same js-yaml dependency in playground-app/package.json.

Suggested reviewers: toddbaert

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description accurately explains the js-yaml security update and documents the unresolved Docker alerts.
Title check	✅ Passed	The title accurately identifies the security-alert dependency work, although it does not name js-yaml.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[toddbaert]

closed/opened to try to fix seemingly stuck checks...

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud