diff --git a/packages/qf-scaffolding/package-lock.json b/packages/qf-scaffolding/package-lock.json
index 05bed3c..edf1a0a 100644
--- a/packages/qf-scaffolding/package-lock.json
+++ b/packages/qf-scaffolding/package-lock.json
@@ -10,7 +10,7 @@
       "license": "PolyForm-Noncommercial-1.0.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.0.4",
-        "js-yaml": "^5.0.0",
+        "js-yaml": "^5.2.0",
         "pdf-parse": "^2.4.5",
         "yaml": "^2.8.2",
         "zod": "^4.4.3"
@@ -1511,9 +1511,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.0.0.tgz",
-      "integrity": "sha512-GSvaPUbk1U+FMZ7rJzF+F8e5YVtu7KnD40et/5rBXXRBv2jCO9L3qCewvIDDdudC0QycTFlf6EAA+h3kxBsuUw==",
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.0.tgz",
+      "integrity": "sha512-YeLUMlvR4Ou1B119LIaM0r65JvbOBooJDc9yEu0dClb/uSC5P4FrLU8OCCz/HXWvtPoIrR0dRzABTjo1sTN9Bw==",
       "funding": [
         {
           "type": "github",
diff --git a/packages/qf-scaffolding/package.json b/packages/qf-scaffolding/package.json
index 2b67078..d11c59f 100644
--- a/packages/qf-scaffolding/package.json
+++ b/packages/qf-scaffolding/package.json
@@ -14,7 +14,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.4",
-    "js-yaml": "^5.0.0",
+    "js-yaml": "^5.2.0",
     "pdf-parse": "^2.4.5",
     "yaml": "^2.8.2",
     "zod": "^4.4.3"