build(deps): resolve js-yaml and undici advisories and gate fresh package versions (#3439)

* build(deps): resolve js-yaml and undici advisories and gate fresh package versions

Pins transitive js-yaml 4.x to 4.3.1 (CVE-2026-59870) and the undici 5.x
chain to the already-pinned 6.28.0, removes the unused http-terminator
dependency, and restores supply-chain cooling-off windows: yarn
npmMinimalAgeGate 3d and a 3-day Dependabot cooldown for npm version
updates (security updates bypass cooldown).

* build(deps): drop redundant js-yaml resolutions in favor of lockfile bump

Both js-yaml 4.x descriptors already admit 4.3.1, so the lockfile
carries the CVE-2026-59870 fix on its own; only the out-of-range
undici 5.x chain needs a resolutions pin.

.github/dependabot.yml

@@ -4,6 +4,8 @@ updates:
     directory: "/"
     schedule:
       interval: daily
+    cooldown:
+      default-days: 3
     groups:
       nestjs:
         patterns:

.yarnrc.yml

@@ -7,6 +7,6 @@ enableScripts: true
 
 nodeLinker: node-modules
 
-npmMinimalAgeGate: 0
+npmMinimalAgeGate: 3d
 
 yarnPath: .yarn/releases/yarn-4.17.1.cjs

apps/server/package.json

@@ -47,7 +47,6 @@
     "cron-validator": "^1.4.0",
     "date-fns": "^4.4.0",
     "email-templates": "13.0.1",
-    "http-terminator": "^3.2.0",
     "lodash": "^4.18.1",
     "mime-types": "^3.0.2",
     "nestjs-zod": "^5.5.0",

package.json

@@ -95,6 +95,7 @@
     "yaml@^1.10.0": "1.10.3",
     "ajv@8.17.1": "8.20.0",
     "undici@^6.19.5": "6.28.0",
+    "undici@^5.25.4": "6.28.0",
     "uuid@^9.0.1": "11.1.1",
     "multer": "2.2.0",
     "linkify-it": "5.0.2",

yarn.lock

@@ -1392,13 +1392,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@fastify/busboy@npm:^2.0.0":
-  version: 2.1.1
-  resolution: "@fastify/busboy@npm:2.1.1"
-  checksum: 10c0/6f8027a8cba7f8f7b736718b013f5a38c0476eea67034c94a0d3c375e2b114366ad4419e6a6fa7ffc2ef9c6d3e0435d76dd584a7a1cbac23962fda7650b579e3
-  languageName: node
-  linkType: hard
-
 "@floating-ui/core@npm:^1.5.3":
   version: 1.5.3
   resolution: "@floating-ui/core@npm:1.5.3"
@@ -3121,7 +3114,6 @@ __metadata:
     eslint: "npm:^10.8.0"
     eslint-config-prettier: "npm:^10.1.8"
     eslint-plugin-jest: "npm:^29.16.0"
-    http-terminator: "npm:^3.2.0"
     jest: "npm:^30.4.2"
     lodash: "npm:^4.18.1"
     mime-types: "npm:^3.0.2"
@@ -9226,13 +9218,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"delay@npm:^5.0.0":
-  version: 5.0.0
-  resolution: "delay@npm:5.0.0"
-  checksum: 10c0/01cdc4cd0cd35fb622518a3df848e67e09763a38e7cdada2232b6fda9ddda72eddcf74f0e24211200fbe718434f2335f2a2633875a6c96037fefa6de42896ad7
-  languageName: node
-  linkType: hard
-
 "delayed-stream@npm:~1.0.0":
   version: 1.0.0
   resolution: "delayed-stream@npm:1.0.0"
@@ -10422,7 +10407,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fast-printf@npm:^1.6.10, fast-printf@npm:^1.6.9":
+"fast-printf@npm:^1.6.10":
   version: 1.6.10
   resolution: "fast-printf@npm:1.6.10"
   checksum: 10c0/630cccbef8349a6eeada9958c9391e9d14b5bd9527dd28d9e7e9f295b006c640ddca8fc2470cff55ea5c6c92ca530488bbadbf7c24f4852ad8c34d9155da9d75
@@ -11399,18 +11384,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"http-terminator@npm:^3.2.0":
-  version: 3.2.0
-  resolution: "http-terminator@npm:3.2.0"
-  dependencies:
-    delay: "npm:^5.0.0"
-    p-wait-for: "npm:^3.2.0"
-    roarr: "npm:^7.0.4"
-    type-fest: "npm:^2.3.3"
-  checksum: 10c0/2f3981c19b12a836620ea4c6bad5b5a135ecb19c5751bfed7a0be543e99cb4b7d0dbffd18eac9c028de3ad1e493445bad503b0564060eb5fb44d02280217b112
-  languageName: node
-  linkType: hard
-
 "https-proxy-agent@npm:^5.0.1":
   version: 5.0.1
   resolution: "https-proxy-agent@npm:5.0.1"
@@ -12638,13 +12611,13 @@ __metadata:
   linkType: hard
 
 "js-yaml@npm:^4.1.0, js-yaml@npm:^4.3.0":
-  version: 4.3.0
-  resolution: "js-yaml@npm:4.3.0"
+  version: 4.3.1
+  resolution: "js-yaml@npm:4.3.1"
   dependencies:
     argparse: "npm:^2.0.1"
   bin:
     js-yaml: bin/js-yaml.js
-  checksum: 10c0/058b30473d6915ca5b4feb11e2f7d4d97242f98d00a798ed48dd90b46b7c640398afe9128c5db22c5300f8c6528fe2a174b9a93f351a70ebc28c6203938d8bff
+  checksum: 10c0/13c500ca322e0c3f8c81686e6ecda96d2ea37b45247a420c17c7db36932d6965cc27391abc2d1a104501600e7f0d947a5f8b7be6db619c4fefa87901b3512807
   languageName: node
   linkType: hard
 
@@ -15523,7 +15496,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"p-wait-for@npm:3.2.0, p-wait-for@npm:^3.2.0":
+"p-wait-for@npm:3.2.0":
   version: 3.2.0
   resolution: "p-wait-for@npm:3.2.0"
   dependencies:
@@ -16902,17 +16875,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"roarr@npm:^7.0.4":
-  version: 7.21.1
-  resolution: "roarr@npm:7.21.1"
-  dependencies:
-    fast-printf: "npm:^1.6.9"
-    safe-stable-stringify: "npm:^2.4.3"
-    semver-compare: "npm:^1.0.0"
-  checksum: 10c0/2fa490bdea0e77c4794735d27e14469b96e733c7286df0191e79759bf87357923ca81523816e1007cbdc5389702a749373bfd29dc91ef1da21d4e925709f8d96
-  languageName: node
-  linkType: hard
-
 "rolldown@npm:1.0.3":
   version: 1.0.3
   resolution: "rolldown@npm:1.0.3"
@@ -17152,13 +17114,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"safe-stable-stringify@npm:^2.4.3":
-  version: 2.5.0
-  resolution: "safe-stable-stringify@npm:2.5.0"
-  checksum: 10c0/baea14971858cadd65df23894a40588ed791769db21bafb7fd7608397dbdce9c5aac60748abae9995e0fc37e15f2061980501e012cd48859740796bea2987f49
-  languageName: node
-  linkType: hard
-
 "safer-buffer@npm:>= 2.1.2 < 3.0.0":
   version: 2.1.2
   resolution: "safer-buffer@npm:2.1.2"
@@ -17271,13 +17226,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"semver-compare@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "semver-compare@npm:1.0.0"
-  checksum: 10c0/9ef4d8b81847556f0865f46ddc4d276bace118c7cb46811867af82e837b7fc473911981d5a0abc561fa2db487065572217e5b06e18701c4281bcdd2a1affaff1
-  languageName: node
-  linkType: hard
-
 "semver-regex@npm:^4.0.5":
   version: 4.0.5
   resolution: "semver-regex@npm:4.0.5"
@@ -18779,7 +18727,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"type-fest@npm:^2.12.2, type-fest@npm:^2.3.3":
+"type-fest@npm:^2.12.2":
   version: 2.19.0
   resolution: "type-fest@npm:2.19.0"
   checksum: 10c0/a5a7ecf2e654251613218c215c7493574594951c08e52ab9881c9df6a6da0aeca7528c213c622bc374b4e0cb5c443aa3ab758da4e3c959783ce884c3194e12cb
@@ -19041,15 +18989,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"undici@npm:^5.25.4":
-  version: 5.29.0
-  resolution: "undici@npm:5.29.0"
-  dependencies:
-    "@fastify/busboy": "npm:^2.0.0"
-  checksum: 10c0/e4e4d631ca54ee0ad82d2e90e7798fa00a106e27e6c880687e445cc2f13b4bc87c5eba2a88c266c3eecffb18f26e227b778412da74a23acc374fca7caccec49b
-  languageName: node
-  linkType: hard
-
 "undici@npm:^7.0.0":
   version: 7.29.0
   resolution: "undici@npm:7.29.0"