[Chore] Bump js-yaml pin for Dependabot alerts #3 and #4

[roomote-roomote]

Created by Roomote. Follow up by mentioning @openmote or in the web UI.

Important

Roomote does not generally accept unsolicited community pull requests. Unless a maintainer invited this PR in an issue or discussion, it will likely be closed without review. A well-written issue is the best way to contribute.

Related issue

Not issue-backed. Internal security maintenance for open Dependabot alerts:

• Dependabot alert #3 — js-yaml prototype pollution in merge (<<) (GHSA-mh29-5h37-fv8m / CVE-2025-64718)
• Dependabot alert #4 — js-yaml merge-key DoS via repeated aliases (GHSA-h67p-54hq-rp68 / CVE-2026-53550)

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

Open medium Dependabot alerts #3 and #4 were still matched because the intentional 3.x pin for read-yaml-file@1 lagged behind the patched 3.15.0 line. Raising that pin clears both without a broad dependency sweep.

What changed

Raised the root pnpm.overrides pin for read-yaml-file@1>js-yaml from 3.14.1 to 3.15.0 and refreshed pnpm-lock.yaml so the remaining development-scope transitive 3.x line resolves to a patched release. The existing monorepo-wide js-yaml override stays at 4.2.0.

After the lockfile refresh, resolved packages are only js-yaml@3.15.0 and js-yaml@4.2.0 (both above the vulnerable ranges for these alerts). No intended user-facing behavior change; production runtime impact should be none/limited because the residual path was transitive and development-scoped.

How it was tested

• Confirmed lockfile packages resolve only to js-yaml@3.15.0 and js-yaml@4.2.0
• pnpm install and pnpm install --frozen-lockfile
• pnpm lint and pnpm check-types

Browser proof not applicable (pin/lockfile-only change).

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset

[roomote-roomote]

No code issues found. See task

Reviewed the read-yaml-file@1>js-yaml override bump from 3.14.1 to 3.15.0 and the refreshed lockfile. The lockfile resolves only js-yaml@3.15.0 and js-yaml@4.2.0, read-yaml-file@1.1.0 correctly picks up 3.15.0, no stale 3.14.1 references remain, and pnpm install --frozen-lockfile passes. Scoped, correct security maintenance change.