diff --git a/README.md b/README.md
index 0632376..9a084b5 100644
--- a/README.md
+++ b/README.md
@@ -325,6 +325,14 @@ When you visit the site, you'll see the output of various cfenv calls.
 changes
 ================================================================================
 
+**1.2.5** - 2025/12/01
+
+- upgrade `js.yaml` to 4.1.x for [CVE-2025-64718][] - [pr #56][]
+
+[pr #56]: https://github.com/cloudfoundry-community/node-cfenv/pull/56
+
+[CVE-2025-64718]: https://www.cve.org/CVERecord?id=CVE-2025-64718
+
 **1.2.4** - 2021/04/03
 
 - upgrade most dependencies, but not CoffeeScript, since the latest
diff --git a/lib/cfenv.js b/lib/cfenv.js
index 704b6f2..c3ab4d0 100644
--- a/lib/cfenv.js
+++ b/lib/cfenv.js
@@ -1,6 +1,6 @@
-// Generated by CoffeeScript 1.12.7
+// Generated by CoffeeScript 1.8.0
 (function() {
-  var AppEnv, URL, _, cfenv, fs, getApp, getBind, getName, getPort, getServices, getURLs, pkg, ports, throwError, yaml;
+  var AppEnv, URL, cfenv, fs, getApp, getBind, getName, getPort, getServices, getURLs, pkg, ports, throwError, yaml, _;
 
   fs = require("fs");
 
@@ -32,7 +32,7 @@
       if (!this.isLocal) {
         try {
           JSON.parse(process.env.VCAP_APPLICATION);
-        } catch (error) {
+        } catch (_error) {
           this.isLocal = true;
         }
       }
@@ -56,16 +56,16 @@
       contents = null;
       try {
         contents = fs.readFileSync(options.vcapFile, 'utf8');
-      } catch (error) {
-        err = error;
+      } catch (_error) {
+        err = _error;
         console.log("error reading vcapFile '" + options.vcapFile + "': " + err + "; ignoring");
         return;
       }
       vcap = null;
       try {
         vcap = JSON.parse(contents);
-      } catch (error) {
-        err = error;
+      } catch (_error) {
+        err = _error;
         console.log("error parsing vcapFile '" + options.vcapFile + "': " + err + "; ignoring");
         return;
       }
@@ -86,13 +86,13 @@
     };
 
     AppEnv.prototype.getServices = function() {
-      var i, len, ref, result, service, services, type;
+      var result, service, services, type, _i, _len, _ref;
       result = {};
-      ref = this.services;
-      for (type in ref) {
-        services = ref[type];
-        for (i = 0, len = services.length; i < len; i++) {
-          service = services[i];
+      _ref = this.services;
+      for (type in _ref) {
+        services = _ref[type];
+        for (_i = 0, _len = services.length; _i < _len; _i++) {
+          service = services[_i];
           result[service.name] = service;
         }
       }
@@ -149,7 +149,7 @@
         value = replacements[key];
         if (key === "auth") {
           userid = value[0], password = value[1];
-          purl[key] = credentials[userid] + ":" + credentials[password];
+          purl[key] = "" + credentials[userid] + ":" + credentials[password];
         } else {
           purl[key] = credentials[value];
         }
@@ -171,21 +171,21 @@
   })();
 
   getApp = function(appEnv, options) {
-    var e, envValue, locValue, ref, string;
+    var e, envValue, locValue, string, _ref;
     string = process.env.VCAP_APPLICATION;
     envValue = {};
     if (string != null) {
       try {
         envValue = JSON.parse(string);
-      } catch (error) {
-        e = error;
+      } catch (_error) {
+        e = _error;
         throwError("env var VCAP_APPLICATION is not JSON: /" + string + "/");
       }
     }
     if (!appEnv.isLocal) {
       return envValue;
     }
-    locValue = options != null ? (ref = options.vcap) != null ? ref.application : void 0 : void 0;
+    locValue = options != null ? (_ref = options.vcap) != null ? _ref.application : void 0 : void 0;
     if (locValue != null) {
       return locValue;
     }
@@ -193,21 +193,21 @@
   };
 
   getServices = function(appEnv, options) {
-    var e, envValue, locValue, ref, string;
+    var e, envValue, locValue, string, _ref;
     string = process.env.VCAP_SERVICES;
     envValue = {};
     if (string != null) {
       try {
         envValue = JSON.parse(string);
-      } catch (error) {
-        e = error;
+      } catch (_error) {
+        e = _error;
         throwError("env var VCAP_SERVICES is not JSON: /" + string + "/");
       }
     }
     if (!appEnv.isLocal) {
       return envValue;
     }
-    locValue = options != null ? (ref = options.vcap) != null ? ref.services : void 0 : void 0;
+    locValue = options != null ? (_ref = options.vcap) != null ? _ref.services : void 0 : void 0;
     if (locValue != null) {
       return locValue;
     }
@@ -215,16 +215,16 @@
   };
 
   getPort = function(appEnv) {
-    var e, port, portString, ref;
-    portString = process.env.PORT || process.env.CF_INSTANCE_PORT || process.env.VCAP_APP_PORT || (appEnv != null ? (ref = appEnv.app) != null ? ref.port : void 0 : void 0);
+    var e, port, portString, _ref;
+    portString = process.env.PORT || process.env.CF_INSTANCE_PORT || process.env.VCAP_APP_PORT || (appEnv != null ? (_ref = appEnv.app) != null ? _ref.port : void 0 : void 0);
     if (portString == null) {
       if (appEnv.name == null) {
         return 3000;
       }
       try {
         portString = "" + (ports.getPort(appEnv.name));
-      } catch (error) {
-        e = error;
+      } catch (_error) {
+        e = _error;
         portString = '3000';
       }
     }
@@ -236,11 +236,11 @@
   };
 
   getName = function(appEnv, options) {
-    var pObject, pString, ref, val, yObject, yString;
+    var pObject, pString, val, yObject, yString, _ref;
     if (options.name != null) {
       return options.name;
     }
-    val = (ref = appEnv.app) != null ? ref.name : void 0;
+    val = (_ref = appEnv.app) != null ? _ref.name : void 0;
     if (val != null) {
       return val;
     }
@@ -260,7 +260,7 @@
       pString = fs.readFileSync("package.json", "utf8");
       try {
         pObject = JSON.parse(pString);
-      } catch (error) {
+      } catch (_error) {
         pObject = null;
       }
       if (pObject != null ? pObject.name : void 0) {
@@ -271,13 +271,13 @@
   };
 
   getBind = function(appEnv) {
-    var ref;
-    return ((ref = appEnv.app) != null ? ref.host : void 0) || "localhost";
+    var _ref;
+    return ((_ref = appEnv.app) != null ? _ref.host : void 0) || "localhost";
   };
 
   getURLs = function(appEnv, options) {
-    var protocol, ref, uri, uris, urls;
-    uris = (ref = appEnv.app) != null ? ref.uris : void 0;
+    var protocol, uri, uris, urls, _ref;
+    uris = (_ref = appEnv.app) != null ? _ref.uris : void 0;
     if (appEnv.isLocal) {
       uris = ["localhost:" + appEnv.port];
     } else {
@@ -294,19 +294,19 @@
       }
     }
     urls = (function() {
-      var i, len, results;
-      results = [];
-      for (i = 0, len = uris.length; i < len; i++) {
-        uri = uris[i];
-        results.push(protocol + "//" + uri);
+      var _i, _len, _results;
+      _results = [];
+      for (_i = 0, _len = uris.length; _i < _len; _i++) {
+        uri = uris[_i];
+        _results.push("" + protocol + "//" + uri);
       }
-      return results;
+      return _results;
     })();
     return urls;
   };
 
   throwError = function(message) {
-    message = pkg.name + ": " + message;
+    message = "" + pkg.name + ": " + message;
     console.log("error: " + message);
     throw new Error(message);
   };
diff --git a/lib/server.js b/lib/server.js
index 13d244e..f9c3850 100644
--- a/lib/server.js
+++ b/lib/server.js
@@ -1,4 +1,4 @@
-// Generated by CoffeeScript 1.12.7
+// Generated by CoffeeScript 1.8.0
 (function() {
   var JL, JS, cfenv, generateDump, http;
 
diff --git a/package.json b/package.json
index 86533cb..f52a8ff 100644
--- a/package.json
+++ b/package.json
@@ -2,7 +2,7 @@
     "name": "cfenv",
     "main": "./lib/cfenv",
     "description": "easy access to your Cloud Foundry application environment",
-    "version": "1.2.4",
+    "version": "1.2.5",
     "author": "pmuellr",
     "license": "Apache-2.0",
     "homepage": "https://github.com/cloudfoundry-community/node-cfenv",
@@ -17,7 +17,7 @@
         "watch": "jbuild watch"
     },
     "dependencies": {
-        "js-yaml": "4.0.x",
+        "js-yaml": "4.1.x",
         "ports": "1.1.x",
         "underscore": "1.12.x"
     },