fix(web-ui): override js-yaml to ^4.3.1 (GHSA-5p4m-2wfm-xmqj)

[Weegy]

What

Pins js-yaml to ^4.3.1 through web-ui's existing overrides block, clearing the high-severity advisory GHSA-5p4m-2wfm-xmqj.

Why

The advisory (quadratic CPU consumption in !!omap resolution; the CVE-2026-59870 fix was not backported) covers 4.0.0 - 4.3.0. web-ui resolves js-yaml@4.3.0 transitively:

eslint@9.39.5 -> @eslint/eslintrc@3.3.6 -> js-yaml@4.3.0

That trips the audit (high+critical block) (web-ui) job. The advisory published after main's last CI run (2026-08-06 09:07 UTC), so main is green only because it has not re-run — every open PR fails this job until it lands. It is not specific to any one branch.

4.3.1 is a patch inside the 4.x line, so eslint itself is untouched. The overrides mechanism is the one already used here for brace-expansion, minimatch and dompurify.

middleware has no js-yaml in its tree at all (npm ls js-yaml → empty) and needs no change — its audit job already passes.

Dev-only dependency: eslint never reaches the shipped bundle. The gate is still repo-wide, which is what makes this blocking.

Test plan

• npm audit --audit-level=high → found 0 vulnerabilities (was: 1 high)
• npm ls js-yaml → js-yaml@4.3.1 overridden
• npm run lint → 0 errors (38 pre-existing warnings) — confirms eslint still loads with the patched js-yaml
• npm run typecheck → clean
• npm run i18n:check → OK
• npx vitest run → 584/584 across 71 files

Risk / blast radius

• Lockfile-only change plus one overrides line: 5 insertions, 4 deletions.
• No production code, no runtime dependency, no shipped-bundle change.
• Worst case is an eslint plugin that depended on 4.3.0-specific behaviour; npm run lint passing rules that out.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}