fix: update js-yaml security override

[corwinm]

Summary

• update the existing js-yaml override boundary and replacement from 4.3.1 to 4.3.2
• refresh only the corresponding lockfile resolution and consumer edges
• resolve GHSA-2883-xcg3-v3hh (>=4.0.0 <4.3.2) without changing the maintained parent toolchain

mocha@11.7.6 already accepts js-yaml through ^4.1.0, so this keeps the remediation to the existing targeted override and lockfile resolution. The final graph resolves every js-yaml path, including @vscode/test-cli -> mocha, to 4.3.2.

Verification

• pnpm install --frozen-lockfile
• pnpm why js-yaml --depth 12
• pnpm list js-yaml --depth 12
• pnpm audit --json — 0 advisories (baseline: 1 high-severity js-yaml advisory)
• pnpm run check-types
• pnpm run lint
• pnpm run verify:release
• pnpm run package
• pnpm exec vsce package --no-dependencies --out /tmp/oil-code-js-yaml-security.vsix — 129,984-byte VSIX
• pnpm run release:dry-run
• pnpm test — 26 tests passed; after the extension host exited successfully, the local VS Code 1.137.0 application process remained open and the command was stopped manually
• git diff --check

Review

• independent codex review --base origin/main: no actionable regressions identified

CI

• GitHub Actions passed on macOS, Ubuntu, and Windows

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-11T16:36:37.018519Z	103aab5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.