fix(deps): bump js-yaml and fast-uri to patch high-severity CVEs

[jithin23-kv]

Summary

Bumps js-yaml (4.2.0 → 4.3.0) and fast-uri (3.1.2 → 3.1.4) in the root lockfile to patch two high-severity CVEs flagged by npm audit / Dependabot:

• js-yaml: YAML merge-key chains can force quadratic CPU consumption (GHSA-52cp-r559-cp3m)
• fast-uri: host confusion via failed IDN canonicalization / backslash authority delimiter (GHSA-4c8g-83qw-93j6, GHSA-v2hh-gcrm-f6hx)

Resolves: https://github.com/KeyValueSoftwareSystems/agent-opfor/security/dependabot/58

Lockfile-only change (package-lock.json), no direct dependency version changes required — both were already within the declared semver ranges.

Test plan

• npm run build passes
• npm test passes (163/163)
• npm audit no longer reports these two High-severity findings

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 09903a34-3293-4327-9a32-dfbcdbf9b51d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/js-yaml-fast-uri-audit

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}