fix: update js-yaml to 4.3.1 to resolve GHSA-5p4m-2wfm-xmqj

[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln — test to make sure that nothing is broken, check compatibility, etc.

• Dependency: js-yaml updated 4.3.0 -> 4.3.1 (also updated overrides and devDependencies semver range from ^4.2.0 to ^4.3.1)
• Advisory: GHSA-5p4m-2wfm-xmqj (CVE-2026-59870, quadratic CPU consumption in !!omap resolution)
• Dependabot alert: https://github.com/warpdotdev/generate-changelog/security/dependabot/77
• Verification: npm audit --audit-level=high -> 0 vulnerabilities. npm run build (tsc) passes. No test suite exists (npm test script absent, jest finds no test files).

Highlight the risky code / where the dependency was used

js-yaml is a devDependency only (used transitively by eslint-plugin-github/eslint tooling), not shipped in dist/. Low runtime risk.

Special instructions for this PR

Dependabot couldn't auto-fix this alert ("Override for js-yaml@4.3.1 conflicts with direct dependency") because the package.json overrides entry was pinned to ^4.2.0, below the patched version. This PR bumps both the overrides and devDependencies entries so the resolved version can reach 4.3.1.

Unrelated pre-existing issue found while verifying (not touched here): npm install/npm ci fail with ERESOLVE due to eslint-plugin-import@2.32.0 peer range (<=9) conflicting with eslint@^10.8.0; npm run lint also fails due to an incompatible @stylistic/eslint-plugin rule name. Both predate this change (reproduced on main before this fix) and needed --legacy-peer-deps to install locally. Repo maintainers may want a separate fix for eslint/eslint-plugin-import compatibility.

AFTER YOU MERGE

None.

[dannyneira]

Superseded by #285 — main couldn't npm install under eslint 10 (eslint-plugin-import peers only ≤9). That PR restores CI and includes this bump. Closing in favor of #285.

[dannyneira]

Closed as superseded by #285.