[GHSA] GHSA-2883-xcg3-v3hh (high) — js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

GHSA-2883-xcg3-v3hh Severity: high CVE: CVE-2026-84375

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

## Summary

`maxTotalMergeKeys` does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit.

## Example

```yaml arr: &arr [{}, {}, {}, ...] # N empty mappings targets: -