[dependabot]

Bumps the production-dependencies group with 1 update: js-yaml.

Updates js-yaml from 5.4.3 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

• Updated argparse to v3.
• Updated development dependencies.

Fixed

• Correct percent-encoding of shorthand and verbatim tags.
• Reject ,, ], and } at the start of block plain scalars, #801.
• Report the exact position of non-printable characters in errors, #801.

Commits

• cb62b2d 5.5.0 released
• 87aed90 Deps bump
• 3aec511 Fix error positions for non-printable characters, #801
• 11aa483 Reject flow indicators at the start of block plain scalars, #801
• 339d8e0 Refactor tag encoder and decoder to match the YAML specification
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Please add a kind label with /kind feature, /kind failing-test or /kind cleanup.

[hivecommons-hive]

1e09e99

ℹ️ Sentinel notice — informational; author is trusted (allow-listed bot), merge is not blocked

Hive flagged this PR (author @dependabot[bot], head 1e09e9964842) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package-lock.json
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

build-test is red for a structural reason, not a flaky one: this repo requires the committed ncc bundle to match source ("Verify committed dist/ matches source" runs npm run pack and fails on any dist/ drift), and Dependabot only edits package.json / package-lock.json — it cannot regenerate dist/index.js. The CI log confirms it: rebuilding at this head leaves dist/index.js | 184 ++--- (119 insertions, 65 deletions) uncommitted, so the check exits 1.

Consequence: as-is this PR cannot go green, and even ignoring the check, merging would ship an action whose committed dist/index.js still bundles js-yaml 5.4.3 while the manifests claim 5.5.0.

The bump itself looks fine — minor version, lockfile is consistent (js-yaml 5.4.3→5.5.0, its argparse dep 2.0.1→3.0.3, integrity hashes updated), unit/e2e checks that don't gate on dist passed.

To land it, someone needs to check out dependabot/npm_and_yarn/production-dependencies-81865a9937, run npm ci && npm run pack, and commit the regenerated dist/ (note: pushing to the branch stops Dependabot from rebasing it further, which is fine right before merge). I have not pushed anything to this branch.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88

[hivecommons-hive]

The build-test failure here is the recurring Dependabot/ncc-bundle class tracked in #171: Dependabot bumps a production dependency that dist/index.js bundles, and nothing in .github/workflows/test.yml regenerates dist/ on its branch, so "Verify committed dist/ matches source" is red by construction (this run: dist/index.js | 184 ++--). Same pattern as #188 before it. main is green, so this is PR-local, not a shared baseline incident.

Two ways to land it:

• a maintainer runs npm ci && npm run pack on this branch and commits dist/ (as the review above says), or
• the repack job proposed in [quality] dependabot PRs bumping ncc-bundled deps always fail the dist/ gate — add a repack-dist job to test.yml #171 lands, after which these PRs go green on their own.

The #171 change lives under .github/workflows/, which the hive's contributor-tier token cannot push, so it still needs a human.

— hive: agent=quality backend=copilot model=claude-fable-5.1

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: unknown