Bump js-yaml and markdownlint-cli

[dependabot]

Bumps js-yaml to 4.2.0 and updates ancestor dependency markdownlint-cli. These dependencies need to be updated together.

Updates js-yaml from 4.1.1 to 4.2.0

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

• Added docs/safety.md with notes about processing untrusted YAML.
• Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
• Added a loader option limiting merge sequence length. Not a problem after merge fix, but an additional restriction for safety.
• Added sourcemaps to dist/ builds.

Changed

• Stop resolving numbers with underscores as numeric scalars, #627.
• Switched dev toolchains to Vite / neostandard.
• Updated demo.
• Reorganized tests.
• dist/ files are no longer kept in the repository.

Fixed

• Fix parsing of properties on the first implicit block mapping key, #62.
• Fix trailing whitespace handling when folding flow scalar lines, #307.
• Reject top-level block scalars without content indentation, #280.
• Ensure numbers survive round-trip, #737.
• Fix test coverage for issue #221.
• Fix flow scalar trailing whitespace folding, #307.
• Fix digits in YAML named tag handles.

Security

• Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

• Backported v4.1.1 fix to v3

Commits

• 590dbab 4.2.0 released
• f944dc5 Add package.json funding field
• f692719 Changelog update
• 9971a06 Fix digits in YAML named tag handles
• 464a5b8 Fix flow scalar trailing whitespace folding, close #307
• 1fda4f7 Tests for #567, #565
• 031ad07 Stop resolving numbers with underscores as numeric scalars, #627
• e46d223 CI config update
• 9023fee Add lockfile
• 990e6f4 Docs update
• Additional commits viewable in compare view

Updates markdownlint-cli from 0.48.0 to 0.49.0

Release notes

Sourced from markdownlint-cli's releases.

v0.49.0

• Update markdownlint dependency to 0.41.0
  • Improve MD022/MD028/MD035/MD042/MD051/MD060
  • Remove handling of inline directive syntax (frequent false positives)
  • Remove support for end-of-life Node version 20
• Update all dependencies via Dependabot

Commits

• a4d5d37 Bump version 0.49.0
• 503f264 Delete and recreate package-lock.json via "npm install".
• 7a24593 Bump markdownlint from 0.40.0 to 0.41.0
• c7c1c76 Bump commander from 14.0.3 to 15.0.0
• 83f5f30 Bump tinyglobby from 0.2.16 to 0.2.17
• 74b98de Bump js-yaml from 4.1.1 to 4.2.0
• d368135 Bump markdown-it from 14.1.1 to 14.2.0
• dd34288 Bump ava from 8.0.0 to 8.0.1
• 1e363dc Bump brace-expansion from 5.0.5 to 5.0.6
• 2f092d2 Bump ava from 7.0.0 to 8.0.0
• Additional commits viewable in compare view

[snyk-io-eu]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[dependabot]

Superseded by #340.