diff --git a/.changeset/lively-finches-forage.md b/.changeset/lively-finches-forage.md
new file mode 100644
index 000000000..10b0eb46d
--- /dev/null
+++ b/.changeset/lively-finches-forage.md
@@ -0,0 +1,5 @@
+---
+type: Security
+pr: 2655
+---
+**Dev-tooling `js-yaml` bumped past the merge-key DoS advisory** — `js-yaml` was pinned `^4.2.0`, inside the vulnerable `4.0.0 - 4.2.0` range of GHSA-52cp-r559-cp3m (quadratic CPU on YAML merge-key chains). It is a devDependency with no shipped-runtime reachability, but `scripts/workflow-policy.cjs` parses workflow frontmatter in CI, which is attacker-controlled on a fork PR. Now `^4.2.1`. (#2654)
diff --git a/package-lock.json b/package-lock.json
index ef0a5ccfb..230d9d369 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -28,7 +28,7 @@
         "eslint-plugin-no-only-tests": "^3.4.0",
         "fast-check": "^4.8.0",
         "globals": "^16.5.0",
-        "js-yaml": "^4.2.0",
+        "js-yaml": "^4.2.1",
         "typescript": "^6.0.3",
         "typescript-eslint": "^8.60.0"
       },
@@ -3842,9 +3842,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
       "dev": true,
       "funding": [
         {
diff --git a/package.json b/package.json
index 1000550c3..9c4d1dcfe 100644
--- a/package.json
+++ b/package.json
@@ -65,7 +65,7 @@
     "eslint-plugin-no-only-tests": "^3.4.0",
     "fast-check": "^4.8.0",
     "globals": "^16.5.0",
-    "js-yaml": "^4.2.0",
+    "js-yaml": "^4.2.1",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.60.0"
   },