NO-TICKET: chore(update): js-yaml vulnerability fix

[aditi-s3]

Title: Address vulnerability issue with js-yaml

Description

Instead of updating to 3.14.2, updated to latest stable version 4.1.1

Checklist

• My code follows the project's coding standards.
• I have run linters/formatters and fixed any issues.
• There are no merge conflicts.
• I have performed a self-review of my code.
• All new and existing tests pass locally.
• I have added license headers to all files.
• (If applicable) I have added unit tests for my changes.
• (If applicable) I have updated the sample app for integration testing.
• (If applicable) I have updated any relevant documentation.

Generative AI usage

• GAI was not used (or, no additional notation is required)
• Coder created a draft manually that was non-substantively modified by GAI (e.g., refactoring was performed by GAI on manually written code)
• GAI was used to create a draft that was subsequently customized or modified
• Code was generated entirely by GAI

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[Copilot]

Pull request overview

This PR addresses a security vulnerability in js-yaml by upgrading all instances from vulnerable versions (3.14.1 and 4.1.0) to the stable version 4.1.1. The update uses Yarn's resolutions field to force consistent versioning across all transitive dependencies in the monorepo workspace.

Key Changes

• Added resolutions field in root package.json to pin js-yaml to version 4.1.1
• Updated yarn.lock to reflect the dependency resolution, removing vulnerable js-yaml versions and their outdated dependencies (argparse ^1.0.7, sprintf-js)
• Consolidated all js-yaml references to use a single pinned version with the updated dependency tree (argparse ^2.0.1)

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Added resolutions field to force js-yaml version 4.1.1 across all workspace packages
yarn.lock	Updated dependency tree removing vulnerable js-yaml versions (3.14.1, 4.1.0) and legacy dependencies, consolidating to pinned version 4.1.1 with updated argparse dependency

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.