- Bumped `js-yaml` from 4.1.1 to 4.2.0 in `frontend/package.json`/`frontend/yarn.lock` to fix [GHSA-h67p-54hq-rp68](https://github.com/advisories/GHSA-h67p-54hq-rp68) (CVE-2026-53550), a quadratic-complexity denial-of-service in merge-key (`<<`) handling triggered by repeated aliases in a merge sequence. Resolves Dependabot alert #138. `js-yaml` is only pulled in transitively by build tooling (not imported from `frontend/src`); `yarn build`/`tsc`/`lint` all pass unchanged.
