chore(deps-dev): bump js-yaml from 4.1.1 to 4.3.0 in /evals

[dependabot]

Bumps js-yaml from 4.1.1 to 4.3.0.

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

• Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
• Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

• maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

• Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

• Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

• [breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

• Added named exports for schemas, tags, parser events and AST utilities.
• Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.
• Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.
• Added dump() transform option for changing the generated AST before rendering.
• Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.
• Added formal data layers (events and AST) for modular data pipelines.
  • Added low-level parser (to events), presenter and visitor APIs.
• Added the YAML Test Suite to the test set.

Changed

• See the migration guide for upgrade notes.
• Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits

• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• 6842ef6 doc polish
• 590dbab 4.2.0 released
• f944dc5 Add package.json funding field
• f692719 Changelog update
• Additional commits viewable in compare view

---

Note

Low Risk
Dev-only dependency bump in the evals package with no application runtime impact; main change is a security hardening backport in YAML parsing.

Overview
Bumps the evals dev dependency js-yaml from 4.1.1 to 4.3.0 in package.json and refreshes package-lock.json.

4.3.0 backports the maxTotalMergeKeys loader option (YAML merge << limits), which is the main functional/security reason for the upgrade. Eval tooling that parses YAML (e.g. build-pr-fixture.js via js-yaml) picks up that behavior on the hoisted install.

The lockfile diff also includes transitive churn from the install (e.g. hoisted @anthropic-ai/sdk 0.115.0 with standardwebhooks, a nested promptfoo copy of SDK 0.92.0, and many packages no longer marked dev: true). Those are lockfile resolution side effects, not separate product changes.

^{Reviewed by Cursor Bugbot for commit 30950f4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Skill eval results

Skill	Before	After	Δ
agentcontrol/configs-create	100/100 (4/4)	0/100 (0/4)	-100
agentcontrol/configs-update	80/100 (4/5)	0/100 (0/5)	-80
agentcontrol/configs-variations	80/100 (4/5)	0/100 (0/5)	-80
agentcontrol/tools	75/100 (3/4)	0/100 (0/4)	-75
feature-flags/flag-and-release-change	-	0/100 (0/4)	new
feature-flags/flag-release	-	0/100 (0/5)	new
feature-flags/launchdarkly-flag-command	-	0/100 (0/3)	new
feature-flags/launchdarkly-flag-create	100/100 (3/3)	0/100 (0/4)	-100
feature-flags/launchdarkly-flag-drift	-	0/100 (0/4)	new
feature-flags/should-flag-change	-	0/100 (0/10)	new

Only suites whose source actually changed since their last recorded score were re-run. Soft-failing while we stabilise the baseline.