Update js-yaml to 4.3.1 (GHSA-5p4m-2wfm-xmqj)

[pdp2121]

Resolves the InfoSec finding for GHSA-5p4m-2wfm-xmqj (js-yaml DoS / resource exhaustion, high).

@redocly/openapi-core  1.34.18 → 1.34.19
js-yaml                4.3.0   → 4.3.1 (deduped to root)
npm audit              2 high  → 0 vulnerabilities

package.json needs no change — the existing openapi-typescript@^7.5.0 range already permits it. Lockfile only.

Scope

The vulnerable package is reached solely through the openapi-typescript devDependency, used by npm run typegen. It is not installed by npm install simplexrpl (and files ships only dist + src), so it was never an exposure in the published SDK — though it did run in CI and on developer machines.

A third js-yaml in the tree is not affected

js-yaml@3.15.1 arrives via ts-jest → @jest/transform → babel-plugin-istanbul → @istanbuljs/load-nyc-config. The advisory range is >=4.0.0 <4.3.1, so 3.x falls outside it and npm audit reports nothing against it. Noting it so it isn't mistaken for a missed instance later.