fix(deps): raise js-yaml floor to ^5.4.1 for GHSA-r3ph-w7gj-g6xm (#20719)

Fixes #20705

Clause-②: no

## Summary

`Validate Package Dependencies` (OSV-Scanner against `pnpm-lock.yaml`)
flags `js-yaml@5.2.3` with GHSA-r3ph-w7gj-g6xm (5.3, fixed in 5.4.1).
`@objectstack/metadata` is the only importer of `js-yaml`, so this PR
raises its declared floor from `^5.2.3` to `^5.4.1` and takes the fix.
It is the take-the-fix path `osv-scanner.toml` describes: the ledger
keeps zero exemptions and is not touched, and neither is
`.github/workflows/validate-deps.yml`.

## Files

- `packages/metadata/package.json`: `js-yaml` `^5.2.3` to `^5.4.1`.
- `pnpm-lock.yaml`: regenerated with a plain `pnpm install
--no-frozen-lockfile --prefer-offline` (pnpm 10.31.0, the
`packageManager` pin), not edited by hand.
- `.changeset/js-yaml-5-4-1-osv-2026-09-29.md`: one `patch` for
`@objectstack/metadata`, `Clause-②: no`.

## Lockfile diff

6 insertions, 6 deletions, three hunks: the metadata importer's
`js-yaml` specifier (`^5.2.3` to `^5.4.1`) and version (`5.2.3` to
`5.4.2`), and the `js-yaml` package and snapshot entries
(`js-yaml@5.2.3` to `js-yaml@5.4.2`; its one dependency `argparse@2.0.1`
is unchanged). Nothing else moves.

## Other js-yaml importers

None. `git grep` over every `package.json` finds `js-yaml` only in
`packages/metadata` (plus `@types/js-yaml` `^4.0.9` as its
devDependency, not a runtime copy). The lockfile had exactly one
`js-yaml` version (5.2.3) and now has exactly one (5.4.2); there are no
transitive copies and no `js-yaml` override in `pnpm-workspace.yaml`.

## What I ran

| Check | Result |
|---|---|
| `npm view js-yaml@5.4.1 version` | 5.4.1 |
| OSV-Scanner v2.3.8 (release SHA-256 verified), `scan
--offline-vulnerabilities --lockfile=pnpm-lock.yaml` on `origin/main`'s
lockfile (control) | exit 1, GHSA-r3ph-w7gj-g6xm on `js-yaml` 5.2.3 |
| The same scan on this branch | exit 0, `No issues found` (1369
packages) |
| `@objectstack/metadata` build (with its dependency closure), typecheck
| pass |
| `@objectstack/metadata` test | 55 files, 828 tests pass |
| `node scripts/pm/dispatch-gates.mjs --commands`, every derived command
run, then `--ran` | 62 derived, 58 pass, 4 NOT MEASURED |

The 4 NOT MEASURED gates are `check:dts-closure`,
`check:dual-build-cjs-loads`, `check:lean-entry-closure` and
`check:sourcemap-no-sources-content`. Each exited 3 (prerequisite not
met): they sweep the whole workspace's `dist/`, which a full `pnpm
build` would supply, and this diff changes no source. CI runs them.

## Changeset

A `patch` for `@objectstack/metadata` with `Clause-②: no`. The only
published change is a dependency-range floor; no exported symbol, option
key or accept/reject verdict moves.

---
🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01VDtqoecgES7ScQYGbFVDRv

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/js-yaml-5-4-1-osv-2026-09-29.md

@@ -0,0 +1,11 @@
+---
+"@objectstack/metadata": patch
+---
+
+`@objectstack/metadata` declares `js-yaml` `^5.4.1` (was `^5.2.3`), clearing GHSA-r3ph-w7gj-g6xm, which affects js-yaml releases before 5.4.1. The lockfile now resolves 5.4.2. `js-yaml` is the YAML parser behind the metadata loader, and it was this package's only importer of it.
+
+Clause-②: no
+
+No exported symbol, option key or accept/reject verdict of ours moves; the published surface is unchanged and grades `patch`. The change is a dependency-range floor, so a fresh install can no longer resolve a vulnerable 5.x copy.
+
+`osv-scanner.toml` keeps zero exemptions and is untouched.

packages/metadata/package.json

@@ -87,7 +87,7 @@
     "@objectstack/types": "workspace:*",
     "chokidar": "^5.0.0",
     "glob": "^13.0.6",
-    "js-yaml": "^5.2.3",
+    "js-yaml": "^5.4.1",
     "zod": "^4.6.1"
   },
   "devDependencies": {