fix(deps): override js-yaml to patched version

[tembo]

Summary

• force the transitive js-yaml dependency to patched version 4.3.2
• regenerate the pnpm lockfile so ESLint and Mocha resolve the patched release

Why

Dependabot's security update for js-yaml repeatedly failed because the package is transitive and pnpm's scoped update completed without changing the lockfile. The existing 4.1.0 resolution is affected by current denial-of-service advisories; 4.3.2 is the first release patched for all current 4.x advisories.

Verification

• pnpm install --frozen-lockfile
• pnpm test (74 passing)
• pnpm build
• pnpm audit --json reports no js-yaml advisory

pnpm lint continues to report four pre-existing array-spacing errors in lib/index.spec.js; this PR does not modify that file.

Want tembo to make any changes? Add a comment with @tembo and i'll get back to work!

      

[tembo]

The failed Dependabot run was on master and was not associated with an originating PR. This follow-up pins the transitive js-yaml resolution to patched 4.3.2; tests and build pass, and the audit no longer reports a js-yaml advisory.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@beyonk/http@50

commit: 6155f79