[HIGH] Pin js-yaml to fixed releases - #58339

Summary

• pin the Istanbul 3.x consumer to js-yaml 3.15.1
• pin the Markdownlint 4.x consumer to js-yaml 4.3.1
• update both existing lockfile entries without changing their major versions

Security impact

The existing 3.14.1 and 4.1.0 releases are affected by quadratic CPU denial-of-service issues in merge-key and ordered-map handling (GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68), plus prototype pollution in merge handling (GHSA-mh29-5h37-fv8m). The resolutions are needed because markdownlint-cli2 0.17.2 requests js-yaml 4.1.0 exactly while React Native still supports Node 20.

Verification

• yarn install --frozen-lockfile --ignore-scripts
• yarn why js-yaml confirmed only 3.15.1 and 4.3.1
• yarn audit no longer reports js-yaml advisories
• yarn build
• yarn lint
• yarn lint-markdown: 40 files, 0 errors
• Babel preset and community CLI: 13 suites, 153 tests, 16 snapshots passed
• git diff --check