[Security]: upgrade js-yaml to 4.3.1 or remove it from the OpenCode path #3671

Package

Other — agent-governance-opencode / TypeScript SDK dependency path

Description

The OpenCode package currently pins js-yaml@4.2.0. Two GitHub-reviewed high-severity advisories affect that release:

• GHSA-52cp-r559-cp3m / CVE-2026-59869 affects js-yaml >=4.0.0,<4.3.0 through crafted YAML merge-key chains.
• GHSA-5p4m-2wfm-xmqj affects js-yaml >=4.0.0,<4.3.1 through quadratic !!omap resolution.

Update (2026-09-13): GHSA-2883-xcg3-v3hh / CVE-2026-84375 also affects versions >=4.0.0,<4.3.2. The effective patched floor for the 4.x line is now 4.3.2; 4.3.1 resolves the original two advisories but not this newer one.

Repository-level overrides also do not protect downstream consumers of published packages. A clean consumer installation may retain an affected transitive version depending on the published SDK constraints and lockfile.

How does this impact your work?

A governance integration should avoid inheriting an attacker-controlled CPU-exhaustion path from policy parsing. The OpenCode surface does not itself impose parser resource caps, so downstream consumers need a patched dependency or removal of YAML parsing from that execution path.

Steps to Reproduce

1. Inspect agent-governance-opencode/package.json and its resolved lockfile entry.
2. Run npm audit in both the repository package and a clean downstream project installing the published OpenCode package.
3. Observe js-yaml@4.2.0 or an older transitive version against GHSA-52cp-r559-cp3m.

Suggested resolution / acceptance criteria

• Upgrade all relevant direct and transitive constraints to js-yaml >=4.3.2, or remove YAML parsing from the OpenCode dependency path.
• Regenerate lockfiles and dependency-audit documentation.
• Verify a clean downstream installation, not only the monorepo override.
• Add/retain parser resource-bound tests where AGT consumes untrusted YAML.

Environment

• Current AGT main at commit 81955d4
• Node 26.7.0
• macOS arm64

Code of Conduct

• I agree to follow the Microsoft Open Source Code of Conduct

Coordination status

• Active repository override/lockfile implementation: docs(deps): record why the js-yaml override floor is 4.3.2 #3894 (4.3.2 across four CLI packages).
• Earlier OpenCode-only PR fix(opencode): upgrade js-yaml to 4.3.1 #3678 is draft and parked in favor of docs(deps): record why the js-yaml override floor is 4.3.2 #3894; do not merge its 4.3.1 pin.
• This issue remains open pending evidence for clean downstream installation and parser resource-bound coverage, or explicitly agreed follow-up tracking.

Please coordinate repository dependency work on #3894 rather than open another competing update. An override-only merge does not by itself complete all acceptance criteria.