🔒 fix: Upgrade Vulnerable js-yaml to 4.3.2

[dustinhealy]

Summary

Upgrade js-yaml to 4.3.2 and override transitive copies so the admin panel uses one patched version, including the exact version requested by xmlbuilder2. This addresses the reported js-yaml security advisories without changing unrelated dependencies.

Change Type

• Bug fix (non-breaking change which fixes an issue)

Testing

• bun install --frozen-lockfile
• bun pm why js-yaml — all paths resolve to 4.3.2
• bunx tsc --noEmit
• bun run test — 27 files, 1,215 tests passed
• bun run build — client and server bundles built
• git diff --check

Area involved and manual test results

• Configuration loading: existing settings and nested read-only YAML previews rendered in the local admin panel.
• YAML import: nested mapping and list inputs validated and reached the import-target step. The import was canceled before applying it. Malformed YAML produced a line-and-column syntax error.
• Configuration save preview and persistence: a reversible setting change showed the expected field and value in the confirmation dialog, saved, and survived reload. The override was then removed; reload confirmed the original unset state.
• Navigation: Dashboard, Configuration, Access, Grants, and Help loaded.
• YAML/code field: no such field is rendered by the current bundled configuration schema, so this component was not exercised interactively.

Test Configuration

Bun 1.3.3 and a local development admin panel. The build reports browser externalization of crypto and large bundle warnings.

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• Local unit tests pass with my changes