chore(deps): override js-yaml to patched 3.15.0 / 4.2.0 (Dependabot)

[ar2rsawseen]

What

Adds two version-scoped npm overrides for the transitive js-yaml dependency in the root manifest, and regenerates package-lock.json:

• js-yaml@^3.0.0 -> ^3.15.0
• js-yaml@^4.0.0 -> ^4.2.0

Why

Resolves the two remaining open js-yaml Dependabot alerts (quadratic-complexity DoS in merge-key handling via repeated aliases):

• medium — js-yaml 4.0.0–4.1.1, patched in 4.2.0
• medium — js-yaml < 3.15.0, patched in 3.15.0

js-yaml is pulled in transitively by dev/build tooling:

• 3.x via grunt and nyc -> @istanbuljs/load-nyc-config
• 4.x via mocha, eslint, and puppeteer -> cosmiconfig

Both patches are within-major (3.14.2 -> 3.15.0, 4.1.1 -> 4.3.0), so every consumer keeps an API-compatible js-yaml. The lockfile diff touches only js-yaml nodes — no unrelated churn — and npm audit reports no remaining js-yaml advisories.

Testing

CI exercises all three consumer paths: lint (eslint), dist-all (grunt), and mochaTest (mocha) — verifying the bumped js-yaml versions don't break linting, the asset build, or the test runner.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the root npm dependency resolution to address js-yaml security advisories by enforcing patched js-yaml versions via overrides, and regenerates the lockfile so installs consistently pick the patched versions across the toolchain (grunt/mocha/eslint/puppeteer, etc.).

Changes:

• Add npm overrides entries to force js-yaml@^3 to ^3.15.0 and js-yaml@^4 to ^4.2.0.
• Regenerate package-lock.json so js-yaml nodes resolve to patched versions (e.g., 3.15.0 and 4.3.0).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Adds version-scoped npm overrides to enforce patched js-yaml versions across transitive dependencies.
package-lock.json	Updates locked js-yaml resolutions to patched versions consistent with the new overrides.