[Security upgrade] bump js-yaml to 4.2.0 in root workspace (#34925)

* [Security upgrade] bump js-yaml 4.1.1 -> 4.2.0 in root workspace

GHSA-h67p-54hq-rp68, patched in 4.2.0. js-yaml 4.x is pulled at runtime via
the patched referer-parser (web) plus many dev/build consumers.

Bumped the existing scoped resolution referer-parser/js-yaml ^4.1.1 -> ^4.2.0
(security floor on the patched-parent path) and re-resolved all 4.x to 4.2.0
(yarn up -R). The js-yaml 3.x line (3.14.2) is a different major, unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Bump js-yaml range in referer-parser patch to ^4.2.0 for consistency

The referer-parser/js-yaml resolution override forces js-yaml to 4.2.0,
but the local patch still declared ^4.1.0. Align the patch's declared
range with the resolution. Addresses Jakob's review comment on #34695
(discussion_r3440549168).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Make patched-parent realignment a mandatory Type B step in yarn-security-update skill

The patch-realignment instruction was a soft 'for consistency' parenthetical;
a session reading the rule acted only on 'use a resolution' and dropped the
patch edit, leaving the resolution at ^4.2.0 while the referer-parser patch
still declared ^4.1.0 (PR #34925). Promote it to an explicit mandatory step.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Fully resolve js-yaml to 4.2.0 and stop patching its range in referer-parser

Add a scoped resolution for @istanbuljs/load-nyc-config/js-yaml so the last
sub-4.2.0 instance (3.14.2, GHSA-h67p-54hq-rp68) is forced to 4.2.0 too;
load-nyc-config uses js-yaml.load(), which is 4.x-compatible.

Drop the js-yaml and mocha dependency edits from the referer-parser patch:
editing a patched package's dependencies has no effect on resolution, so the
scoped resolution is the entire fix. Update the yarn-security-update skill to
match (patched parents route to Type B; do not edit the patch).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Combine js-yaml resolutions into a single global override

Replace the two scoped js-yaml resolutions (referer-parser/js-yaml and
@istanbuljs/load-nyc-config/js-yaml) with one global "js-yaml": "^4.2.0". Every
js-yaml consumer should reach the security floor and none needs an older major,
so the global override is equivalent and tidier (reviewer request).

Note the scoped-vs-global tradeoff in the yarn-security-update skill.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 1738cbc04f4cacbfb6880ba6f176a192aa4a03f7

.yarn/patches/referer-parser-npm-0.0.3.patch

@@ -9,18 +9,6 @@ diff --git a/package.json b/package.json
    "description": "library for extracting marketing attribution data (such as search terms) from referrer URLs",
    "main": "index.js",
    "scripts": {
-@@ -15,9 +15,9 @@
-     }
-   ],
-   "dependencies": {
--    "js-yaml": "~2.1.0"
-+    "js-yaml": "^4.1.0"
-   },
-   "devDependencies": {
--    "mocha": "~1.12.0"
-+    "mocha": "~10.2.0"
-   }
- }
 diff --git a/index.js b/index.js
 --- a/index.js
 +++ b/index.js

package.json

@@ -37,7 +37,7 @@
     "@xmldom/xmldom": "0.8.13",
     "argparse/underscore": "1.13.8",
     "east/underscore": "1.13.8",
-    "referer-parser/js-yaml": "^4.1.1",
+    "js-yaml": "^4.2.0",
     "sandboxed-module": "patch:sandboxed-module@npm%3A2.0.4#~/.yarn/patches/sandboxed-module-npm-2.0.4-f8b45aacc9.patch",
     "request/tough-cookie": "5.1.2",
     "request/form-data": "2.5.6",

yarn.lock

@@ -13308,15 +13308,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"argparse@npm:^1.0.7":
-  version: 1.0.10
-  resolution: "argparse@npm:1.0.10"
-  dependencies:
-    sprintf-js: "npm:~1.0.2"
-  checksum: 10c0/b2972c5c23c63df66bca144dbc65d180efa74f25f8fd9b7d9a0a6c88ae839db32df3d54770dcb6460cf840d232b60695d1a6b1053f599d84e73f7437087712de
-  languageName: node
-  linkType: hard
-
 "argparse@npm:^2.0.1":
   version: 2.0.1
   resolution: "argparse@npm:2.0.1"
@@ -22362,26 +22353,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"js-yaml@npm:^3.13.1":
+"js-yaml@npm:^4.2.0":
-  version: 3.14.2
+  version: 4.2.0
-  resolution: "js-yaml@npm:3.14.2"
+  resolution: "js-yaml@npm:4.2.0"
-  dependencies:
-    argparse: "npm:^1.0.7"
-    esprima: "npm:^4.0.0"
-  bin:
-    js-yaml: bin/js-yaml.js
-  checksum: 10c0/3261f25912f5dd76605e5993d0a126c2b6c346311885d3c483706cd722efe34f697ea0331f654ce27c00a42b426e524518ec89d65ed02ea47df8ad26dcc8ce69
-  languageName: node
-  linkType: hard
-
-"js-yaml@npm:^4.1.0, js-yaml@npm:^4.1.1":
-  version: 4.1.1
-  resolution: "js-yaml@npm:4.1.1"
   dependencies:
     argparse: "npm:^2.0.1"
   bin:
     js-yaml: bin/js-yaml.js
-  checksum: 10c0/561c7d7088c40a9bb53cc75becbfb1df6ae49b34b5e6e5a81744b14ae8667ec564ad2527709d1a6e7d5e5fa6d483aa0f373a50ad98d42fde368ec4a190d4fae7
+  checksum: 10c0/1916456c118746603b067d74bbcbb0445d9a1d5e474ad4ae775e7b20525bed902e01d9d97dd0c81fcd8d4f596162309d0eb057f4aa38f3e9647f14075e9dea45
   languageName: node
   linkType: hard
 
@@ -29496,10 +29475,10 @@ __metadata:
 
 "referer-parser@patch:referer-parser@npm%3A0.0.3#~/.yarn/patches/referer-parser-npm-0.0.3.patch":
   version: 0.0.3
-  resolution: "referer-parser@patch:referer-parser@npm%3A0.0.3#~/.yarn/patches/referer-parser-npm-0.0.3.patch::version=0.0.3&hash=3b17c1"
+  resolution: "referer-parser@patch:referer-parser@npm%3A0.0.3#~/.yarn/patches/referer-parser-npm-0.0.3.patch::version=0.0.3&hash=a5f138"
   dependencies:
     js-yaml: "npm:~2.1.0"
-  checksum: 10c0/e2ff496ff36c893bbc6e27579d041086f705a137f5bf9357bc71df9bba7e9144b0adcf81e8320bcbf5a49828daaabee945a34cc6ef86f148314d2cfb16341685
+  checksum: 10c0/53f6eaa03feff6c2d61660a661423b7c1247d898c45d380b477d5a6048acd9c6bb6418532731fcca83c4bc7d575688ecc920a38abe16d330eeaa4862eba23267
   languageName: node
   linkType: hard
 
@@ -31355,13 +31334,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"sprintf-js@npm:~1.0.2":
-  version: 1.0.3
-  resolution: "sprintf-js@npm:1.0.3"
-  checksum: 10c0/ecadcfe4c771890140da5023d43e190b7566d9cf8b2d238600f31bec0fc653f328da4450eb04bd59a431771a8e9cc0e118f0aa3974b683a4981b4e07abc2a5bb
-  languageName: node
-  linkType: hard
-
 "sprintf-kit@npm:^2.0.2":
   version: 2.0.2
   resolution: "sprintf-kit@npm:2.0.2"