R11DT-4252 - Bump vulnerable deps in swagger-ui (js-yaml)

[OS-thiagosiqueira]

Jira Issue

R11DT-4252

The problem

Wiz flags js-yaml@4.3.1 against the b11 branch: CVE-2026-84375 (GHSA-2883-xcg3-v3hh,
CVSS 7.5 High, CWE-400/407) — maxTotalMergeKeys does not count empty-mapping merge sources.
A YAML document with many repeated empty << merges bypasses the configured budget and burns
CPU without limit:

"js-yaml": {
  "severity": "high",
  "title": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",
  "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh",
  "range": "3.0.0 - 3.15.1 || 4.0.0 - 4.3.1"
}

Proposed solution

Patch-level bump only, same surgical-bump pattern as #207 — no src/ changes required:

Where	Change
package.json	js-yaml =4.3.1 → =4.3.2
package-lock.json	direct dep resolved to 4.3.2; nested @istanbuljs/load-nyc-config copy (dev-only, Jest coverage config loading) bumped 3.15.0 → 3.15.2 — same advisory, already in-range via its own ^3.13.1 spec, so npm update js-yaml picked it up for free
dist/swagger-ui-bundle.js, -es-bundle.js, -es-bundle-core.js, -standalone-preset.js, swagger-ui.js	rebuilt — each is an independent webpack bundle target that inlines js-yaml
dist/index.html	cache-busting ?v= hashes refreshed for the bundles whose bytes changed

Verification:

• npm audit — 0 js-yaml findings (both instances cleared).
• npm audit --omit=dev (production scope) — 0 vulnerabilities.
• npm ls js-yaml --all — all 8 resolutions in the tree now on patched versions.
• Smoke-parsed a sample OpenAPI YAML doc directly against js-yaml@4.3.2 — parses correctly, no API change.