chore(deps): patch dev-only transitive advisories (js-yaml, uuid) via overrides

[dknauss]

What

Patches the dev-only transitive npm advisories that are safely fixable via overrides, following the established pattern from #60. None of these ships in the plugin — all are dev/test/build tooling.

Advisory	Package	Fix	Status
GHSA-h67p-54hq-rp68 — ReDoS in YAML merge keys	js-yaml <= 4.1.1	override → ^4.2.0	✅ fixed
GHSA-w5hq-g745-h8pq — missing buffer bounds check	uuid < 11.1.1	override → ^14.0.0	✅ fixed

Only js-yaml was raised as a GitHub Dependabot alert (#53); the uuid one surfaces only in npm audit.

js-yaml → 4.2.0

Only vulnerable copy was js-yaml@3.14.2 via Jest coverage tooling (babel-plugin-istanbul → @istanbuljs/load-nyc-config → js-yaml@^3.13.1). API-safe: load-nyc-config only calls .load(), present in both v3 and v4. Dedups the v3 subtree (prunes v3-only argparse@1 + sprintf-js).

uuid → 14.0.x

Vulnerable copies were uuid@8.3.2 (via sockjs / webpack-dev-server) and uuid@9.0.1 (via @wordpress/components); uuid 14.x was already in the tree. API-safe: sockjs uses require('uuid').v4, @wordpress/components uses named from 'uuid' — both still exported by v14; neither passes buf, so the flaw was never reachable. Dedups nine nested @wordpress/*/node_modules/uuid copies.

Verification

• npm ls js-yaml → only 4.2.0 · npm ls uuid → only 14.0.1 (no vulnerable copies)
• npm audit no longer lists js-yaml or uuid
• npm run build ✅ · npm test → 668 passed ✅ · load-nyc-config requires cleanly ✅
• Lockfiles net smaller (pure dedup); no runtime/production deps touched

Deliberately NOT fixed (no safe override)

• showdown ReDoS (GHSA-rmmh-p597-ppvv) — vulnerable range is <= 2.1.0, and 2.1.0 is the latest published version. No patched release exists to override to. (Reaches us via @wordpress/blocks/components.)
• @opentelemetry/core baggage (GHSA-8988-4f7v-96qf) — fix is only in 2.8.0, a major bump. The installed 1.30.1 sits in a version-locked 1.x OpenTelemetry stack pulled via @sentry/node; forcing core to 2.x alone would break its 1.x peers. This needs an upstream Sentry dependency bump, not an override.

Both remain dev-only and were not raised as Dependabot alerts.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.80%. Comparing base (e7c829b) to head (62750d1).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #62   +/-   ##
=======================================
  Coverage   80.80%   80.80%           
=======================================
  Files          44       44           
  Lines        3084     3084           
  Branches      523      523           
=======================================
  Hits         2492     2492           
  Misses        185      185           
  Partials      407      407           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.