diff --git a/osv-scanner.toml b/osv-scanner.toml
index c7438ff39d..0d37838227 100644
--- a/osv-scanner.toml
+++ b/osv-scanner.toml
@@ -66,6 +66,10 @@ reason = "tar infinite loop via negative entry size; transitive via lerna/yeoman
 id = "GHSA-jmr9-qjv8-65gv"
 reason = "extract-zip unvalidated symlink path traversal on extraction (CVE-2026-56876); transitive via cypress and @puppeteer/browsers, both dev-only tooling; extracted archives are Cypress/Chromium binary release downloads from trusted sources, never untrusted user-supplied zips; no upstream fix (last_affected: 2.0.1, which is the latest release). Re-evaluate on 2026-11-13: drop this exclusion if extract-zip ships a patched release"
 
+[[IgnoredVulns]]
+id = "GHSA-7pqw-9j4j-h8q3"
+reason = "extract-zip arbitrary file write via symlink at final path component (CVE-2026-19693); transitive via cypress and @puppeteer/browsers, both dev-only tooling; extracted archives are Cypress/Chromium binary release downloads from trusted sources, never untrusted user-supplied zips; no upstream fix (last_affected: 2.0.1, which is the latest release). Re-evaluate on 2026-11-13: drop this exclusion if extract-zip ships a patched release"
+
 [[IgnoredVulns]]
 id = "GHSA-w4pp-8pjf-rmxw"
 reason = "pacote DoS via addGitSha on malicious spec.rawSpec (CVE-2026-9496); transitive via lerna (pinned pacote@21.0.1), @npmcli/arborist, and yeoman-generator (dev-time only); fix only in pacote 21.5.1+/22.0.0 which lerna does not yet support; all specs processed come from our own package.json/yarn.lock, never untrusted input"
diff --git a/package.json b/package.json
index a34078ad24..3749bfff98 100644
--- a/package.json
+++ b/package.json
@@ -158,7 +158,7 @@
     "sigstore": "4.1.1",
     "**/bn.js": "5.2.3",
     "uuid": "11.1.1",
-    "js-yaml": "4.3.1",
+    "js-yaml": "4.3.2",
     "ip-address": "10.4.0",
     "socket.io-parser": "4.2.7",
     "nanoid": "3.3.18",
@@ -231,7 +231,7 @@
     "sigstore": "4.1.1",
     "bn.js": "5.2.3",
     "uuid": "11.1.1",
-    "js-yaml": "4.3.1",
+    "js-yaml": "4.3.2",
     "ip-address": "10.4.0",
     "socket.io-parser": "4.2.7",
     "sanitize-html": "2.17.5",
diff --git a/yarn.lock b/yarn.lock
index f0b2b47a0e..c39a071f3a 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -14029,10 +14029,10 @@ js-xdr@^1.1.3:
     lodash "^4.17.5"
     long "^2.2.3"
 
-js-yaml@4.1.0, js-yaml@4.3.1, js-yaml@^3.13.1, js-yaml@^3.14.1, js-yaml@^4.1.0:
-  version "4.3.1"
-  resolved "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz#01216c001d67f48e2cd560d708c7af21090a3848"
-  integrity sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==
+js-yaml@4.1.0, js-yaml@4.3.2, js-yaml@^3.13.1, js-yaml@^3.14.1, js-yaml@^4.1.0:
+  version "4.3.2"
+  resolved "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz#8e44fb14a2643c59726bb15787b5f1512cb3d3fb"
+  integrity sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==
   dependencies:
     argparse "^2.0.1"