fix(deps): pin js-yaml to the GHSA-2883-xcg3-v3hh patched releases

[acamarata]

Problem

Dependency Audit on main has failed since 2026-09-08 (run 34827360640):

6 vulnerabilities found
Severity: 2 moderate | 4 high (2 ignored)
##[error]Process completed with exit code 1

The two actionable high findings are both GHSA-2883-xcg3-v3hh — js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources, published 2026-09-08.

advisory range	first patched	this repo pinned
>= 3.0.0, < 3.15.2	3.15.2	3.15.1
>= 4.0.0, < 4.3.2	4.3.2	4.3.1

Both overrides sat exactly one patch below the fix. js-yaml is only ever transitive here — 962 paths through metro → cosmiconfig, 32 through @expo/cli → @expo/xcpretty — so pnpm.overrides is the only place it can be fixed.

Change

-      "js-yaml@3": "3.15.1",
-      "js-yaml@4": "4.3.1",
+      "js-yaml@3": "3.15.2",
+      "js-yaml@4": "4.3.2",

Verification

Reproduced the workflow exactly (@nself stubs, pnpm install --no-frozen-lockfile, pnpm audit --audit-level=high):

EXIT=0
4 vulnerabilities found
Severity: 2 moderate | 2 high (2 ignored)

Store resolves js-yaml@3.15.2 and js-yaml@4.3.2.

The two ignored advisories are untouched and still unfixed upstream

auditConfig.ignoreCves is unchanged. Re-checked both today:

advisory	package	vulnerable	first patched
GHSA-w3rx-r6r6-pgpr	image-size	<= 2.0.2	NONE
GHSA-5p2g-fcmc-qvqq	image-size	<= 2.0.2	NONE

image-size@2.0.2 is still npm latest, so there is no published fix to take. Nothing was added to the ignore list in this PR.