Bump js-yaml to 3.15.2 to clear GHSA-2883-xcg3-v3hh

[matt-humaan]

Clears the one npm audit finding in this repo, for SUP-4013.

The finding

js-yaml 3.15.1, high severity — GHSA-2883-xcg3-v3hh, where maxTotalMergeKeys fails to limit CPU use for empty merge sources.

It is dev-only, and reaches us as a transitive of the test runner:

ava@8.0.1 → supertap@3.0.1 → js-yaml@^3.14.1

The fix

3.15.2 is the patched release inside supertap's ^3.14.1 range, so a plain npm update js-yaml resolves it. No overrides needed. The diff is 3 lines of package-lock.json.

npm audit now reports 0 vulnerabilities. The demo/ workspace was already clean, and those are the only two manifests in the repo.

Verification

Fresh npm ci on node 22.23.2, then npm test (build + oxlint + oxfmt + ava) — 102 tests passed, matching the baseline taken before the change.

Not run: npm run test:browser (Playwright) and the React 18/19 CI matrix. A dev-only YAML test reporter can't affect either, and CI covers both on this PR.

Note for anyone updating deps here

The first attempt at this produced a 108-line diff, because npm 10 strips the libc fields from optional platform-specific packages — a field npm 11 wrote and npm 10 doesn't understand. This lockfile was generated with npm 11, so running npm update under npm 10 silently degrades it. This commit was made with npm 11.11.0 to keep the diff clean.

npm ci is unaffected, so CI on node 22 is fine either way.

🤖 Generated with Claude Code

[linear-code]

SUP-4013

[cursor]

Risk: low. Approved this in-range js-yaml lockfile bump; Bugbot passed with no findings and no reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver - Risk Based}