fix: address CVEs and cleanup yarn resolutions

[ruanyl]

Summary

• Upgrade transitive js-yaml from 3.14.2 to 3.15.0.
• Upgrade react-view’s transitive diff from 3.5.0 to 4.0.4.
• Upgrade sass-lint-auto-fix’s transitive cookie from 0.4.1 to 0.7.2.
• Remove 36 redundant Yarn resolutions, reducing the total from 69 to 33.
• Regenerate yarn.lock, removing 45 orphaned resolution-only selectors.

Security findings

• CVE-2026-59869: addressed by js-yaml@3.15.0.
• CVE-2026-24001: addressed by diff@4.0.4.
• CVE-2024-47764: addressed by cookie@0.7.2.

CVE-2026-53550 recommends js-yaml@4.2.0, but existing sass-lint and svgo consumers depend on the removed safeLoad API. Fully addressing it requires upgrading or replacing those consumers rather than forcing an incompatible major version.

Resolution cleanup

Each resolution was removed and regenerated with Yarn in an isolated worktree. All cleanup candidates were then removed together to account for overlapping rules.

The resulting lockfile had no version changes among surviving selectors. Each of the remaining 33 resolutions changes at least one resolved version when removed.

Issues Resolved

Check List

• New functionality includes testing.
• New functionality has been documented.
• All tests pass
  • yarn lint
  • yarn test-unit
• Update CHANGELOG.md
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[SuZhou-Joe]

Really excited to see we are removing those pinned resolutions.