Bump js-yaml to 4.3.2 and markdown-it to 14.3.2 to fix CG security alerts

[Sandeep Kumar Das (Sandeep-622)]

Related Issue

Fixes Component Governance security alerts on AdaptiveCards-WinUi3-Renderer-Release (no GitHub issue): CVE-2026-59869, GHSA-5p4m-2wfm-xmqj, CVE-2026-84375 (js-yaml 4.1.0) and CVE-2026-48801, CVE-2026-59887 (linkify-it 5.0.0).

Description

All five alerts come from source/nodejs/package-lock.json.

• js-yaml 4.1.0 -> 4.3.2. Root and adaptivecards-site devDependencies now ask for ^4.3.2. mocha, lerna and nx require exactly 4.1.0, so this adds npm overrides ("js-yaml@4": "^4.3.2" plus a nested mocha override) to force them onto the patched version. js-yaml 3.x copies are left unchanged.
• linkify-it 5.0.0 -> 5.0.2 by raising markdown-it from ^14.0.0 to ^14.3.2 (root, adaptivecards-react, adaptivecards-site). This is a minor version bump within 14.x.

Lockfile changes are limited to js-yaml, markdown-it, linkify-it and uc.micro. Resolved URLs are registry.npmjs.org with sha512 integrity, matching the existing entries.

Sample Card

N/A (dependency update only).

How Verified

1. No new tests, because the change only updates dependency versions.
2. Ran locally:
   • Checked the lockfile: no js-yaml 4.x below 4.3.2 and no linkify-it below 5.0.2 remain.
   • npm ls --package-lock-only --all reports no problems.
   • npm ci completes.
   • lerna run build succeeds for adaptivecards and adaptivecards-react (adaptivecards-react bundles markdown-it).
   • @microsoft/ac-typed-schema build-and-test passes (28 tests).
   • @microsoft/marked-schema test passes.
   • adaptivecards jest: 24 of 25 suites pass. carousel.spec.ts fails to compile (TS2554: two calls pass 5 arguments where 4 are expected). That file is unrelated to these packages; I did not re-run it on main.

[Copilot]

Copilot review overview

🟢 Approval recommended

The manifests and lockfile consistently resolve the targeted vulnerable dependency versions, with appropriate verification reported.

Review effort: Balanced
Findings: None

What changed in this PR

Updates Node.js dependencies to resolve Component Governance security alerts.

Changes:

• Upgrades js-yaml, enforced through npm overrides.
• Upgrades markdown-it, resolving linkify-it 5.0.2.
• Refreshes the lockfile for updated transitive dependencies.

File	Description
source/​nodejs/​package.json	Updates root dependencies and overrides.
source/​nodejs/​package-lock.json	Locks patched dependency versions.
source/​nodejs/​adaptivecards-site/​package.json	Updates site development dependencies.
source/​nodejs/​adaptivecards-react/​package.json	Updates the renderer’s markdown-it dependency.

Files not reviewed (1)

• source/nodejs/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.