fix(deps): clear js-yaml and postcss dev-scope advisories

[stevan-borus]

Clears both open Dependabot alerts on main. Neither had a PR open.

Severity	Package	Advisory	Was	Now
High	js-yaml	Quadratic CPU consumption in !!omap resolution (CVE-2026-59870 not backported)	4.3.0	4.3.1
Moderate	postcss	Attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset	8.5.22	8.5.26

Both are development-scope only — neither reaches published dist/, so no consumer of the package was ever affected. The practical exposure was CI and local builds.

The js-yaml override had gone stale

Worth flagging, since it is the actual reason this alert was open rather than covered.

97e0821 added "js-yaml@<4.2.0": "^4.2.0" for an earlier advisory. That selector only rewrites versions matching <4.2.0 — but the new advisory covers >=4.0.0 <4.3.1. We were resolving 4.3.0, which no longer matched the selector, so the override quietly applied to nothing while still looking active in package.json.

Widened to <4.3.1, and added the same style of guard for postcss.

Pinned js-yaml to ^4.3.1 rather than latest (5.2.3) deliberately — 5.x is a major and @changesets/cli is what pulls this in, so staying on the 4.x line avoids risking the release path for a dev-only fix.

Verification

• pnpm audit --audit-level=low — No known vulnerabilities found
• Lockfile confirmed: no vulnerable versions remain
• pnpm test -- --run — 35/35 passing
• pnpm build — OK (CJS + ESM + declarations)
• pnpm changeset status — CLI runs correctly on js-yaml 4.3.1, confirming the release tooling still works

No changeset: dev dependencies only, nothing reaches published dist/.

Note: biome:check still prints the $schema version notice on this branch — that is fixed separately in #21 and is info-level, so CI stays green.

[stevan-borus]

Update: #21 has since merged, so the $schema caveat at the bottom of the description no longer applies — once this branch picks up main, biome:check is fully clean with no info notice.