From 388b0ea224f04d4f10b227812e45b9b1213e55f4 Mon Sep 17 00:00:00 2001
From: Pixnop <77785313+Pixnop@users.noreply.github.com>
Date: Sun, 20 Sep 2026 14:47:00 +0200
Subject: [PATCH] Update js-yaml past the merge-key CPU advisory

Bumps the js-yaml override from 4.3.1 to ^4.3.2, closing GHSA-2883-xcg3-v3hh
(maxTotalMergeKeys does not limit CPU use for empty merge sources).

js-yaml is transitive only: electron-updater pulls it in for parsing the
auto-update feed, and electron-builder and eslint's @eslint/eslintrc pull
it in for build and lint tooling. The launcher's own code never imports
js-yaml directly.
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index bc2aa8e8..50807060 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -7690,9 +7690,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "funding": [
         {
           "type": "github",
diff --git a/package.json b/package.json
index 9b37e38e..80d999bf 100644
--- a/package.json
+++ b/package.json
@@ -3,7 +3,7 @@
   "version": "1.7.0-beta.10",
   "description": "RiftLauncher for Vintage Story",
   "overrides": {
-    "js-yaml": "4.3.1",
+    "js-yaml": "^4.3.2",
     "tar": "7.5.22"
   },
   "main": "./out/main/index.js",