chore: Remediate 2 Dependabot security alerts (js-yaml 3.x/4.x)

[ernst-dev]

Summary

Upgrades js-yaml (3.15.0→3.15.1, 4.3.0→4.3.1) and react-router-dom (^6.30.4→^7.18.2, dev dependency) to resolve all 5 open Dependabot security alerts.

NPMPM availability

Not applicable — all upgraded packages are dev-only dependencies (dev: true in lockfile). No non-dev dependency versions increased.

Alerts resolved

Package	Major line	Vulnerable range	Resolved version	Severity	Advisory
js-yaml	3.x	>= 3.0.0, < 3.15.1	3.15.1	high	GHSA-5p4m-2wfm-xmqj
js-yaml	4.x	>= 4.0.0, < 4.3.1	4.3.1	high	GHSA-5p4m-2wfm-xmqj
react-router	6.x	>= 6.0.0, < 7.18.0	7.18.2	medium	GHSA-wrjc-x8rr-h8h6 / CVE-2026-53669
react-router	6.x	>= 6.4.0, < 7.18.0	7.18.2	medium	GHSA-337j-9hxr-rhxg / CVE-2026-53666
react-router-dom	6.x	>= 6.30.2, <= 6.30.4	7.18.2	medium	GHSA-jjmj-jmhj-qwj2 / CVE-2026-53668

Remediation details

• Rung used: 3 (targeted lockfile splice — HW4) — no patch available for react-router within 6.x; js-yaml patch versions exist (3.15.1, 4.3.1).
• Override added: No
• Lockfile splice (HW4): Applied to avoid npm's full tree reconciliation. The spliced diff contains only the security-relevant entries and their transitive requirements.
• Peer dep note: react-router-dom 7 has peerDependencies: {react: '>=18'} but this repo pins react@^16.14.0. Since react-router-dom is only a dev dependency, this mismatch is acceptable.
• Classification:
  • ALERT-DRIVEN: js-yaml 3.15.0 → 3.15.1, js-yaml 4.3.0 → 4.3.1, react-router 6.30.4 → 7.18.2, react-router-dom 6.30.4 → 7.18.2
  • COLLATERAL: cookie@1.1.1 added (new react-router dep), set-cookie-parser@2.7.2 added (new react-router dep), @remix-run/router@1.23.3 removed (no longer used in v7)

Unresolved alerts

None — merging this PR is expected to CLEAR ALL 5 open Dependabot alerts for this repo.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.08%. Comparing base (e5a1656) to head (9960970).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #245   +/-   ##
=======================================
  Coverage   98.08%   98.08%           
=======================================
  Files          55       55           
  Lines        1771     1771           
  Branches      492      519   +27     
=======================================
  Hits         1737     1737           
+ Misses         34       33    -1     
- Partials        0        1    +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.