fix(VUL-27078): bump js-yaml to 3.15.1 in example lockfile

[samwise-service]

Summary

Bumps the transitive js-yaml dependency from 3.15.0 to 3.15.1 in example/package-lock.json to remediate a quadratic CPU consumption (ReDoS-style) vulnerability in !!omap resolution.

js-yaml is not a direct dependency of the example app — it is pulled in transitively via jest → @istanbuljs/load-nyc-config (^3.13.1). Per remediation policy for transitive dependencies, the fix is applied via an overrides entry in example/package.json (pinning js-yaml to ^3.15.1) plus a regenerated lockfile, rather than adding it as a new direct dependency.

Jira Tickets Resolved

• https://getpantheon.atlassian.net/browse/VUL-27078

CVE Table

Package	Advisory	Severity	Description	Fixed in
js-yaml	GHSA-5p4m-2wfm-xmqj	High	Quadratic CPU consumption in !!omap resolution (3.x and 4.x); the CVE-2026-59870 fix for the omap DoS was not backported to the 3.x line prior to 3.15.1	3.15.1

Changes

• example/package.json: added js-yaml: ^3.15.1 to the overrides block (transitive dep, not promoted to a direct dependency).
• example/package-lock.json: regenerated to resolve js-yaml to 3.15.1.

Risk assessment

Rating: Undetermined — the service-maturity skill reference was unavailable in this environment, so the full defense-in-depth scoring could not be run. Manual note: this is a patch-level bump (3.15.0 → 3.15.1) of a dev-only, transitive test-tooling dependency in the example sub-project (not shipped in the published package), so the blast radius of this change is low.