chore: update vulnerable Node.js dependencies

[vikrantpuppala]

Summary

• Update browserslist from 4.28.4 to 4.28.7 and refresh its required browser-data entries.
• Update transitive js-yaml 3.x from 3.15.1 to 3.15.2.
• Update transitive js-yaml 4.x from 4.3.1 to 4.3.2.

These changes address the blocking repository security-scan findings, including GHSA-2883-xcg3-v3hh (CVE-2026-84375).

Testing

• npm run build
• npm run prettier
• env -u CODEX_CI npm test — 1,290 passing
• npm ls js-yaml --all — resolves only patched 3.15.2 and 4.3.2
• npm audit — 0 vulnerabilities
• git diff --check

[peco-review-bot]

✅ No issues identified by the review bot.

[peco-review-bot]

Verdict: 1 Medium

Dependency-only lockfile update (security patches for js-yaml plus browserslist data refresh) — mechanically sound, but one medium concern: the js-yaml resolved URLs now point at the internal npm-proxy.cloud.databricks.com host, which will break npm ci for external contributors. Everything else uses the public registry.

[peco-review-bot]

🟡 Medium — The refreshed js-yaml entries (both 3.15.2 and 4.3.2, in every nested copy) now have resolved URLs pointing at the internal https://npm-proxy.cloud.databricks.com/... registry instead of the public https://registry.npmjs.org/.... This is a public, widely-consumed open-source connector, so external contributors running npm ci (which installs strictly from the resolved URLs in the lockfile) will fail to fetch these tarballs since the Databricks proxy host is not publicly reachable. The other bumped packages (browserslist, caniuse-lite, etc.) correctly retained registry.npmjs.org, so the js-yaml entries are inconsistent with the rest of the lockfile. Recommend regenerating the lockfile against the public registry so all resolved URLs use registry.npmjs.org. The integrity hashes are content-addressed and will match either way, but the host must be publicly resolvable.

[peco-review-bot]

✅ No issues identified by the review bot.