fix(site): bump js-yaml to 4.3.1 and 3.15.1 (GHSA-5p4m-2wfm-xmqj)

[CybotTM]

Fixes two open Dependabot alerts for js-yaml (GHSA-5p4m-2wfm-xmqj, high severity) in site/package-lock.json: alert #23 (js-yaml >= 4.0.0, < 4.3.1) and alert #22 (js-yaml >= 3.0.0, < 3.15.1). Dependabot opened no fix PR for these (both instances are transitive devDependencies), so this bumps them manually.

Both patched versions satisfy the consumers' existing semver ranges, so the change is lockfile-only (npm update js-yaml) — no package.json change, no overrides: js-yaml 4.3.0 → 4.3.1 (consumer @11ty/eleventy, range ^4.1.1) and js-yaml 3.15.0 → 3.15.1 (consumer gray-matter, range ^3.13.1).

Verification: npm ls js-yaml --all shows only 4.3.1 and 3.15.1; npm run build (87 pages written), npm run check and npm run check:hreflang (81 pages, 0 gaps) all pass locally on Node 26 / npm lockfileVersion 3.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/js-yaml	3.15.1	🟢 6.1	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review ⚠️ 1 Found 3/30 approved changesets -- score normalized to 1 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 27 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 4 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/js-yaml	4.3.1	🟢 6.1	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review ⚠️ 1 Found 3/30 approved changesets -- score normalized to 1 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 27 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 4 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• site/package-lock.json

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[CybotTM]

Self-review (Copilot review unavailable — monthly quota exhausted; diff reviewed manually plus an adversarial review pass, no findings).

Checked on head cb4f30a: lockfile-only diff, 6 lines each way, moving exactly the two vulnerable transitive js-yaml instances to their patched lines (4.3.0 → 4.3.1 under @11ty/eleventy, 3.15.0 → 3.15.1 under gray-matter); both consumers' existing semver ranges cover the patched versions, so no package.json change and no overrides were needed. npm ls js-yaml --all shows only patched versions, the Eleventy build and the repo's check scripts pass, and all 10 CI checks are green. Merging closes Dependabot alerts #22 and #23 (GHSA-5p4m-2wfm-xmqj).