[HIGH] Manual fix required: CVE-2026-59869 — lock regen timed out

[Pattern Security Automation (pattern-security-automation)]

⚠️ Security Alert: HIGH CVE Requires Manual Fix

This PR was opened by Pattern Security Automation. The version bump was prepared
automatically, but the lock file could not be regenerated because lock regen timed out.
CI will likely fail. This PR is a notification — please follow the steps below.

---

CVE Details

Field	Value
CVE	CVE-2026-59869
Severity	HIGH
Repository	patterninc/heimdall
Vulnerable package	js-yaml
Required fix version	4.3.0
Current version	^4.1.0
Dependency type	Direct
Language	javascript

Why Automated Fix Was Blocked

The pipeline bumped web/package.json successfully but could not regenerate
the lock file before the Lambda time limit:

timed out after 300s for patterninc/heimdall

Large modules or slow registry access can exceed the automated lock regen budget.
Please regenerate the lock file locally and push to this branch.

What This PR Contains

• web/package.json — updated to target 4.3.0
• No lock file update — CI will fail until you regenerate it manually

Steps to Fix

1. Check out this branch locally
2. Regenerate the lock file:
   • Go: go mod tidy
   • npm/yarn: npm install or yarn install
   • uv: uv lock
   • poetry: poetry lock
   • bundler: bundle update js-yaml
3. Commit the updated lock file to this branch and push — CI should then pass
4. Ping #wiz-alerts if you need help

References

• View in Wiz

Developer feedback

Was this automation helpful? Share feedback (takes ~1 min)

---

Auto-generated by Pattern Security Automation

[Copilot]

Pull request overview

Updates the web app’s direct dependency on js-yaml to address CVE-2026-59869 (HIGH). The PR currently only updates the version spec in web/package.json; lock regeneration is still required for reproducible installs and CI success.

Changes:

• Bump js-yaml from ^4.1.0 to ^4.3.0 in web/package.json.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.