fix(security): bump js-yaml 4.3.1 -> 4.3.2 (GHSA-2883-xcg3-v3hh) (#3032)

js-yaml < 4.3.2 is affected by a high-severity uncontrolled-resource-
consumption issue (CWE-400 / CWE-407, CVSS 7.5): maxTotalMergeKeys does
not limit CPU use for empty merge sources, allowing a crafted YAML
document with merge keys to cause a denial of service while parsing.

js-yaml is a direct runtime dependency (it is also pinned via `overrides`
and `resolutions`), so the bump is applied in all three package.json
locations and both lockfiles are regenerated. 4.3.2 is a non-breaking
patch release; `npm audit --audit-level=high` and an immutable
`yarn install` both pass afterward.

Advisory: https://github.com/advisories/GHSA-2883-xcg3-v3hh

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

package-lock.json

@@ -11,7 +11,7 @@
       "dependencies": {
         "@iarna/toml": "2.2.5",
         "ajv": "8.20.0",
-        "js-yaml": "4.3.1",
+        "js-yaml": "4.3.2",
         "sql.js": "1.14.2"
       },
       "bin": {
@@ -1493,9 +1493,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "funding": [
         {
           "type": "github",

package.json

@@ -479,7 +479,7 @@
   "dependencies": {
     "@iarna/toml": "2.2.5",
     "ajv": "8.20.0",
-    "js-yaml": "4.3.1",
+    "js-yaml": "4.3.2",
     "sql.js": "1.14.2"
   },
   "pi": {
@@ -509,13 +509,13 @@
   "overrides": {
     "fast-uri": "3.1.7",
     "markdown-it": "14.3.0",
-    "js-yaml": "4.3.1",
+    "js-yaml": "4.3.2",
     "@humanfs/node": "0.16.8"
   },
   "resolutions": {
     "fast-uri": "3.1.7",
     "markdown-it": "14.3.0",
-    "js-yaml": "4.3.1",
+    "js-yaml": "4.3.2",
     "@humanfs/node": "0.16.8"
   },
   "packageManager": "yarn@4.9.2+sha512.1fc009bc09d13cfd0e19efa44cbfc2b9cf6ca61482725eb35bbc5e257e093ebf4130db6dfe15d604ff4b79efd8e1e8e99b25fa7d0a6197c9f9826358d4d65c3c"

yarn.lock

@@ -606,7 +606,7 @@ __metadata:
     c8: "npm:11.0.0"
     eslint: "npm:10.9.1"
     globals: "npm:17.11.0"
-    js-yaml: "npm:4.3.1"
+    js-yaml: "npm:4.3.2"
     markdownlint-cli: "npm:0.49.1"
     sql.js: "npm:1.14.2"
     typescript: "npm:6.0.3"
@@ -1082,14 +1082,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"js-yaml@npm:4.3.1":
-  version: 4.3.1
-  resolution: "js-yaml@npm:4.3.1"
+"js-yaml@npm:4.3.2":
+  version: 4.3.2
+  resolution: "js-yaml@npm:4.3.2"
   dependencies:
     argparse: "npm:^2.0.1"
   bin:
     js-yaml: bin/js-yaml.js
-  checksum: 10c0/13c500ca322e0c3f8c81686e6ecda96d2ea37b45247a420c17c7db36932d6965cc27391abc2d1a104501600e7f0d947a5f8b7be6db619c4fefa87901b3512807
+  checksum: 10c0/dedd34c2e8fef1d504687f1bc94ed0ee1311a1f78770fa2800352c6d59c635ccf555009d74e9afe529ae62199da2b1ccef30e53dc84dcd8d2d8187c22574bc97
   languageName: node
   linkType: hard