From f6c0051f59aa024045c5084390a0ac9f860fff8a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=98yvind=20Gjesdal?= <oyvind.gjesdal@uib.no>
Date: Wed, 7 Oct 2026 22:18:26 +0200
Subject: [PATCH 1/2] Bump js-yaml from 4.1.1 to 4.3.2 in
 /jena-fuseki2/jena-fuseki-ui

Updated with:

yarn up -R js-yaml

Fixes two security advisories for dev-dependencies

Explanation from Claude:

The vulnerable copy comes from @cypress/code-coverage (^4.1.1), a dev
dependency. Dependabot could not update it because
@istanbuljs/load-nyc-config needs js-yaml ^3.13.1, and it looks for one
version for both. Updated with `yarn up -R js-yaml`, which re-resolves
each copy within its own range: lockfile only, no resolutions entry.
The 3.x copy (3.15.2) is unchanged and already has both fixes.
---
 jena-fuseki2/jena-fuseki-ui/yarn.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/jena-fuseki2/jena-fuseki-ui/yarn.lock b/jena-fuseki2/jena-fuseki-ui/yarn.lock
index ae3749b50ec..7a9e391ea5f 100644
--- a/jena-fuseki2/jena-fuseki-ui/yarn.lock
+++ b/jena-fuseki2/jena-fuseki-ui/yarn.lock
@@ -5967,13 +5967,13 @@ __metadata:
   linkType: hard
 
 "js-yaml@npm:^4.1.1":
-  version: 4.1.1
-  resolution: "js-yaml@npm:4.1.1"
+  version: 4.3.2
+  resolution: "js-yaml@npm:4.3.2"
   dependencies:
     argparse: "npm:^2.0.1"
   bin:
     js-yaml: bin/js-yaml.js
-  checksum: 10c0/561c7d7088c40a9bb53cc75becbfb1df6ae49b34b5e6e5a81744b14ae8667ec564ad2527709d1a6e7d5e5fa6d483aa0f373a50ad98d42fde368ec4a190d4fae7
+  checksum: 10c0/dedd34c2e8fef1d504687f1bc94ed0ee1311a1f78770fa2800352c6d59c635ccf555009d74e9afe529ae62199da2b1ccef30e53dc84dcd8d2d8187c22574bc97
   languageName: node
   linkType: hard
 

From 03955bd9092b4336d4001b27178a414e16be4746 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=98yvind=20Gjesdal?= <oyvind.gjesdal@uib.no>
Date: Wed, 7 Oct 2026 22:32:32 +0200
Subject: [PATCH 2/2] add a resolution to use a newer shell-quote awaiting
 update to concurrently

add entry to resolution
update lockfile
---
 jena-fuseki2/jena-fuseki-ui/package.json | 3 ++-
 jena-fuseki2/jena-fuseki-ui/yarn.lock    | 8 ++++----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/jena-fuseki2/jena-fuseki-ui/package.json b/jena-fuseki2/jena-fuseki-ui/package.json
index 5c6d41c3ecd..be430d9d4a2 100644
--- a/jena-fuseki2/jena-fuseki-ui/package.json
+++ b/jena-fuseki2/jena-fuseki-ui/package.json
@@ -84,7 +84,8 @@
   "resolutions": {
     "on-headers": ">=1.1.0",
     "picomatch": ">=4.0.4",
-    "minimatch": ">=9.0.7"
+    "minimatch": ">=9.0.7",
+    "shell-quote": "^1.12.0"
   },
   "packageManager": "yarn@4.18.0+sha512.fcb8716fe7cd0eece141ffc18b92193a9df9204c1ba83189c288835223fc0bbe64af473bab0d5e9927a7daeb5caf2bb07eb2787cc9338ca040ea125f2a1f2f7e"
 }
diff --git a/jena-fuseki2/jena-fuseki-ui/yarn.lock b/jena-fuseki2/jena-fuseki-ui/yarn.lock
index 7a9e391ea5f..243a804f8cc 100644
--- a/jena-fuseki2/jena-fuseki-ui/yarn.lock
+++ b/jena-fuseki2/jena-fuseki-ui/yarn.lock
@@ -8028,10 +8028,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"shell-quote@npm:1.9.0":
-  version: 1.9.0
-  resolution: "shell-quote@npm:1.9.0"
-  checksum: 10c0/a39960107eb086b02394cfceb3c732bd3bf567b568719ff47101448fc3f1bf4a59ecfdd8960ff7ea564d749ef8bda70f2c82a768f22d8c7aeeabf2b64f53b7e8
+"shell-quote@npm:^1.12.0":
+  version: 1.12.0
+  resolution: "shell-quote@npm:1.12.0"
+  checksum: 10c0/1605a4ed6a758bf13de7cb8197a4184d8015f7a4dbdcd6cd4a717d5b30b3ae7666300cc4ae7f3155cf80ace9739e9e82061ee5aa1a648f53f5fab31a220816d0
   languageName: node
   linkType: hard