From f89e188a9f83ac484608ccc7d2822914afbb1e82 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 16 Sep 2026 23:17:20 -0300
Subject: [PATCH] deps: bump js-yaml (#13212)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Merged as-is — single-file lockfile bump in `/electron`, 3 lines, transitive resolution only.

js-yaml 4.3.2 hard-limits the merge-sequence size and counts empty mappings toward `maxTotalMergeKeys` (nodeca/js-yaml#797) — CPU-DoS hardening, which is worth taking promptly and carries no API surface change.

Verified against the tip before merging: `electron/package-lock.json` is the only file touched.