fix: patch js-yaml DoS (GHSA-h67p-54hq-rp68) via override

Force js-yaml to 3.15.0 (the official 3.x patch for the quadratic-complexity
DoS in merge-key alias handling) via a pnpm override. It reaches us through
gray-matter@4.0.3 -> vitepress-plugin-llms; gray-matter requires js-yaml
^3.13.1, so 3.15.0 stays in range and is API-compatible.

Also drop the auditConfig.ignoreGhsas suppression for this advisory, which was
based on the now-outdated assumption that the 3.x line could not be patched.

Author: sriramveeraghanta

pnpm-lock.yaml

@@ -13,20 +13,12 @@ overrides:
   vite: 6.4.3 # was 6.4.2 — GHSA-fx2h-pf6j-xcff (high), GHSA-v6wh-96g9-6wx3
   postcss: 8.5.15 # GHSA-qx2v-qp2m-jg93 (via vite)
   uuid: 11.1.1 # GHSA-w5hq-g745-h8pq (via mermaid; stays in mermaid's ^11 range)
+  js-yaml: 3.15.0 # GHSA-h67p-54hq-rp68 quadratic-DoS via merge-key aliases (via gray-matter; stays in its ^3.13.1 range)
 
 peerDependencyRules:
   allowedVersions:
     vitepress: "2"
 
-auditConfig:
-  ignoreGhsas:
-    # js-yaml 3.x quadratic-DoS via merge-key aliases (CVE-2026-53550).
-    # gray-matter@4.0.3 hard-pins js-yaml 3.x (uses safeLoad/safeDump, removed
-    # in 4.x) and has no newer release; the fix only landed in js-yaml >=4.2.0,
-    # so 3.x cannot be patched. js-yaml here only parses this repo's own
-    # build-time frontmatter (trusted input), so the DoS is not reachable.
-    - GHSA-h67p-54hq-rp68
-
 # Build scripts left disabled (matching prior pnpm 10 behavior — neither was
 # ever approved, and the site builds fine without them). Flip to true to allow.
 allowBuilds: