fix: update js-yaml transitive dep from 3.14.1 to 3.15.0 to unblock Dependabot security job @[copilot-swe-agent[bot]](https://github.com/apps/copilot-swe-agent) (#31)
Dependabot's security update job was failing with `security_update_not_possible` for `js-yaml` — it correctly identified the vulnerable `3.14.1` as installed but couldn't resolve a fix due to apparent conflicts with the `^4.1.0` requirement from `eslint`.Root cause
js-yaml@3.14.1 was pulled in transitively via:
babel-plugin-istanbul → @istanbuljs/load-nyc-config@1.1.0 → js-yaml@^3.13.1 → 3.14.1
This is independent of the direct js-yaml@^4.3.0 devDependency, but Dependabot's resolver treated the ^4.x requirement from eslint as a blocker for the ^3.x range update.
Change
yarn.lock: Pinnedjs-yaml@^3.13.1resolution to3.15.0(lowest non-vulnerable 3.x release per Dependabot's own advisory data). Added theesprima "^4.0.0"dependency that3.15.0introduces (already present in the lockfile from other packages).