fix(deps): bump js-yaml to >=4.2.0 to resolve GHSA-h67p-54hq-rp68

[BYK]

Summary

Resolves 3 Dependabot alerts (#186, #187, #188), all the same advisory across both projects.

• Advisory: GHSA-h67p-54hq-rp68 / CVE-2026-53550 — js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases (medium severity)
• Vulnerable: `>= 4.0.0, <= 4.1.1` → patched: `4.2.0`

These alerts were opened by the post-merge rescan right after #839 landed (newly-published advisory), not caused by that change.

Fix

Alert	Manifest	Relationship	Change
#187	root `package.json`	direct devDep	bump pinned `js-yaml` `4.1.1` → `4.2.0`
#188	root `pnpm-lock.yaml`	direct devDep	regenerated → `4.2.0`
#186	`docs/pnpm-lock.yaml`	transitive (astro/starlight)	`pnpm.overrides` `js-yaml: ^4.2.0` → resolves to `4.3.0`

• Root uses an exact pin (matching the repo's pinned-devDep convention, e.g. `tar`); docs uses an override (matching the docs override style) since js-yaml is transitive there.
• Both lockfile diffs are 100% js-yaml-scoped — no unrelated drift. No `@babel/core`/other packages touched.

Verification

• Root: `pnpm build` ✅, `pnpm test` ✅ (1025 passed, 1 skipped), `pnpm lint` ✅ (0 errors), `pnpm format:check` ✅ (tracked files)
• Docs: `pnpm build` ✅ (27 pages built)
• `grep "js-yaml@" pnpm-lock.yaml docs/pnpm-lock.yaml` — only `4.2.0`/`4.3.0` remain; `4.1.1` gone. (`@types/js-yaml` is type-defs only, not the vulnerable package.)

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-07-01 13:36 UTC