fix: override picomatch and yaml package security alerts

[yeojz]

Summary

• Override picomatch@>=4.0.0 <4.0.4 to >=4.0.4 to fix ReDoS vulnerability and method injection in POSIX character classes (GHSA-c2c7-rcm5-vvqj, GHSA-3v7f-55p6-f55p)
• Override yaml@>=2.0.0 <2.8.3 to >=2.8.3 to fix stack overflow via deeply nested YAML collections (GHSA-48c2-rrv3-qjmp)

Test plan

• pnpm audit reports 0 vulnerabilities
• All 1158 tests pass

[codecov]

Bundle Report

Bundle size has no change ✅

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	100% (🎯 100%)	1556 / 1556
🔵	Statements	100% (🎯 100%)	1577 / 1577
🔵	Functions	100% (🎯 100%)	346 / 346
🔵	Branches	100% (🎯 100%)	824 / 824

File Coverage

No changed files found.

Generated in workflow #361 for commit befd07f by the Vitest Coverage Report Action

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (bfe9d7a) to head (befd07f).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #822   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           59        59           
  Lines         1996      1996           
  Branches       404       428   +24     
=========================================
  Hits          1996      1996           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.