fix(DSO-26757): bump js-yaml to 4.3.2

[nurislam03]

https://mitarbeiterapp.atlassian.net/browse/DSO-26757

Type of Change

• Dependency

Description

What: Bump js-yaml resolutions pin from 4.3.0 to 4.3.2 in samples/weather-forecast (package.json + yarn.lock).

Why: CVE-2026-84375 — empty-merge CPU DoS where maxTotalMergeKeys fails for empty merges. Fixed in js-yaml 4.3.2. Lockfile confirmed resolving 4.3.0 (vulnerable) before this change.

How to review: Check git diff main — two files, resolutions pin + regenerated lockfile entry. Verify with yarn install --frozen-lockfile && yarn build && yarn test in samples/weather-forecast. All green locally (build ok, lint ok, type-check ok, 19/19 tests pass).

Checklist

• Make sure all tests pass
• Update documentation
• Review the Contributing Guideline and sign CLA

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[staffbase-actions]

🟢 Sucessfully merged into the dev branch.
It can take up to a few minutes until the changes are rolled out to the dev system.
The following Pull Requests are merged into the dev branch:

• https://redirect.github.com/Staffbase/custom-widgets-examples/pull/320

[review-swarm]

Staffbase AI Code Review

Verdict: ✅ Approved

Diff classified as trivial (≤10 lines, ≤5 files). No reviewers run.

📌 Only the first push is reviewed automatically. After that, comment @swarm review to re-review the latest commit.

• Risk tier: trivial
• Size: XS (trivial to review)
• Head commit: 9887edd
• Findings: 0 critical, 0 warning, 0 suggestions

Findings

No findings.

---

Bot commands

• @swarm ignore <id> [<id>...] — dismiss one or more findings by id (space-separated, including criticals — review each one before dismissing).
• @swarm ignore-all — dismiss every open warning/suggestion (criticals must be dismissed explicitly via ignore <id>).
• @swarm reset-ignores — clear all dismissals on this PR.
• @swarm review — re-run the review against the latest commit.

You can also resolve a non-critical inline conversation to ignore it (and unresolve to bring it back). Resolving a critical conversation is not supported — use ignore <id> instead.

To bypass the entire review (criticals included), apply the break-glass label to the PR.

Execution Steps (3)

1. Filter Diff — ✅ completed
   • Files: 1, +1/-1 lines
2. Reviewer Pipeline — ⏭️ skipped
   • Reason: trivial tier
3. Judge Pass — ⏭️ skipped
   • Reason: trivial tier