[codex] fix(ci): override js-yaml audit advisory

[calvin-archastro]

What changed

Adds an npm override for js-yaml@4.2.0 and refreshes package-lock.json so the JS tooling audit gate passes again.

Root cause

The failed run 27842330152 stopped in the Regenerate SDK workflow before Python setup or SDK regeneration. The failing step was:

npm audit --audit-level=moderate

The advisory path was:

@stoplight/prism-cli@5.14.2
  -> json-schema-faker@0.5.8
  -> json-schema-ref-parser@6.1.0
  -> js-yaml@3.14.2

js-yaml <=4.1.1 is now flagged for GHSA-h67p-54hq-rp68. Prism is intentionally pinned at 5.14.2, and testing newer Prism did not remove the vulnerable chain. Overriding only js-yaml to 4.2.0 clears the audit without changing Prism.

Scope

JS tooling metadata only:

• package.json
• package-lock.json

No generated Python SDK files are included.

Testing

Ran from a clean branch based on origin/main:

npm ci --ignore-scripts
npm audit --audit-level=moderate
git diff --check

Result: npm audit reports found 0 vulnerabilities; whitespace check passed.

[archastro]

✅ Clean PR, @calvin-archastro! No blocking findings on 358d710 — a few nice things I clocked:

• Nice surgical fix — overriding only js-yaml to 4.2.0 clears GHSA-h67p-54hq-rp68 without disturbing the intentionally-pinned @stoplight/prism-cli@5.14.2. 🎯
• Clean lockfile refresh — argparse bumped to 2.0.1 and the now-orphaned esprima/sprintf-js removed, integrity hashes intact.

---

_{Reply @archastro <verb>: review · do <pattern> · don't <pattern> · forget <slug> · list}