chore(deps): update js-yaml in markdownlint-cli2 dependency [security]

[lakoone]

What/Why/How?

Fixed js-yaml Dependabot alerts (#172, #176, #186 — CVE-2026-59869, CVE-2026-53550, GHSA-5p4m-2wfm-xmqj):

• markdownlint-cli2 exact-pins js-yaml 4.1.1; added a scoped override "markdownlint-cli2": { "js-yaml": "^4.3.1" } so it resolves 4.3.1.
• Bumping markdownlint-cli2 itself (0.20 → 0.23) was rejected: it changes lint rules drastically (226 → 11333 errors). The override keeps lint behavior identical.
• Remove the override when markdownlint-cli2 ships js-yaml >= 4.3.1 (its 0.23+ line ships 5.x).

Reference

https://github.com/Redocly/website/security/dependabot/176

Testing

• npm run lint:markdown reports exactly the same 226 pre-existing errors as main — no behavior change.
• Lockfile now resolves only js-yaml 4.3.1 / 5.3.0.

Screenshots (optional)

Check yourself

• Code is linted
• Tested
• All new/updated code is covered with tests

Security

• Security impact of change has been considered
• Code follows company security practices and guidelines

[redocly]

marketing-site AI Review: 🟢 Completed

Note

Low Risk

This PR contains a low-risk development dependency update. It introduces a version override that only affects the markdown linting tool, meaning it has zero impact on production code or runtime behavior.

Overview

• Adds an override in package.json to force markdownlint-cli2 to use js-yaml version ^4.3.1.
• Updates package-lock.json to reflect the patched lockfile tree, removing the vulnerable 4.1.1 version of js-yaml.
• Fixes Dependabot security alerts (CVE-2026-59869, CVE-2026-53550, GHSA-5p4m-2wfm-xmqj) while deliberately avoiding a full upgrade to markdownlint-cli2 which would cause disruptive lint rule changes.