security: resolve js-yaml DoS advisories (dependabot #36/#37) — fix on develop, pending release

[kokevidaurre]

What

Dependabot reports 2 open medium-severity alerts on the default branch, both the js-yaml quadratic-complexity DoS in merge-key handling advisory:

• [UX]: Running squads without arguments exits with code 1 #37 — js-yaml < 3.15.0 (runtime, via gray-matter)
• [Docs]: No CLAUDE.md file for AI assistant context #36 — js-yaml >= 4.0.0, <= 4.1.1 (dev)

State

Already fixed on develop: package.json overrides pin js-yaml to ~3.15.0 / ^4.2.0 and the lockfile resolves every instance to 3.15.0 / 4.3.0 (verified 2026-07-14). main still resolves 3.14.2 (runtime) and 4.1.1 (dev), which is what dependabot scans.

Action

• Ships automatically with the next develop→main release — no code change needed
• After release: confirm dependabot auto-dismisses alerts [Docs]: No CLAUDE.md file for AI assistant context #36/[UX]: Running squads without arguments exits with code 1 #37, then close this issue

Severity is moderate and the vector is YAML parsing of crafted input; no urgent out-of-band release needed.