fix(DSO-26715): bump js-yaml override to 3.15.2

[nurislam03]

https://mitarbeiterapp.atlassian.net/browse/DSO-26715

What has been done?

• Bumped the js-yaml npm override in package.json to 3.15.2; regenerated package-lock.json (3.15.0 -> 3.15.2).

Why was this done?

• CVE-2026-84375 (js-yaml empty-merge CPU DoS): 3.15.2 is the backport of the 4.3.2 fix for v3-only trees. The dep is transitive via @istanbuljs/load-nyc-config (^3.13.1, jest coverage chain), so the v3-range override is kept and just moved to the fixed version.

How to test the changes?

1. npm install resolves cleanly, lockfile shows js-yaml 3.15.2 only
2. npm run lint passes; npm test green (6 suites, 158 tests)

[review-swarm]

Staffbase AI Code Review

Verdict: ✅ Approved

Diff classified as trivial (≤10 lines, ≤5 files). No reviewers run.

📌 Only the first push is reviewed automatically. After that, comment @swarm review to re-review the latest commit.

• Risk tier: trivial
• Size: XS (trivial to review)
• Head commit: 6bd1246
• Findings: 0 critical, 0 warning, 0 suggestions

Findings

No findings.

---

Bot commands

• @swarm ignore <id> [<id>...] — dismiss one or more findings by id (space-separated, including criticals — review each one before dismissing).
• @swarm ignore-all — dismiss every open warning/suggestion (criticals must be dismissed explicitly via ignore <id>).
• @swarm reset-ignores — clear all dismissals on this PR.
• @swarm review — re-run the review against the latest commit.

You can also resolve a non-critical inline conversation to ignore it (and unresolve to bring it back). Resolving a critical conversation is not supported — use ignore <id> instead.

To bypass the entire review (criticals included), apply the break-glass label to the PR.

Execution Steps (3)

1. Filter Diff — ✅ completed
   • Files: 1, +1/-1 lines
2. Reviewer Pipeline — ⏭️ skipped
   • Reason: trivial tier
3. Judge Pass — ⏭️ skipped
   • Reason: trivial tier

[robertvangor]

LGTM