chore(deps): update js-yaml to patched releases

[Changyong Gong (chagong)]

Summary

Fix all five currently open Dependabot alerts by updating only development-time js-yaml resolutions in package-lock.json:

• Top-level js-yaml: 4.2.0 -> 4.3.2, used by Mocha (^4.1.0) and webpack-cli's optional peer (^4.0.0 || ^5.0.0).
• TSLint's nested js-yaml: 3.14.2 -> 3.15.2, satisfying TSLint's ^3.13.1 constraint.

Generated with npm update js-yaml --package-lock-only --ignore-scripts --no-fund. Preserve lockfile version 2, both lockfile representations, all parent versions/constraints and every unrelated resolution. No manifest, runtime source, overrides, test or changelog changes.

Alert coverage

Alerts	Advisory	Safe floors	Locked versions
111, 110	GHSA-5p4m-2wfm-xmqj: quadratic ordered-map resolution	3.15.1 / 4.3.1	3.15.2 / 4.3.2
100, 101	GHSA-52cp-r559-cp3m: quadratic merge-key chains	3.15.0 / 4.3.0	3.15.2 / 4.3.2
96	GHSA-h67p-54hq-rp68: repeated merge-alias CPU exhaustion	3.15.0	3.15.2

Validation

• npm ci --ignore-scripts --no-fund passed.
• npm run build-server && npm test && npm run tslint passed on Windows with Node 22.15.1, npm 10.9.2 and JDK 21; all 61 tests passed. The Maven wrapper directory was added only to process-local PATH because this host sets NoDefaultCurrentDirectoryInExePath=1.
• Verified every locked js-yaml instance and legacy lock entry against all advisory ranges, all three parent constraints, and ordinary merge/ordered-map parsing. Exact graph comparison permits only 12 version/URL/integrity changes plus upstream MIT license metadata; no unrelated graph delta.
• npm audit --package-lock-only --ignore-scripts --json no longer reports js-yaml. The two unchanged low-severity diff/Mocha audit findings correspond to already auto-dismissed alerts 49 and 46, both GHSA-73rr-hh4g-fpgx. No broad audit fix or alert-state changes.

Local caveat: two earlier full runs failed the multi-module import-tree assertion after 54 passing tests. The final unchanged patched full run passed all 61, as did the exact original-lock full baseline; the isolated multi-module suite passed with both old and new versions. The intermittent failure's cause was not established. No assertions, timeouts or source were changed; generated fixture settings were restored.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.