fix(release): override read-yaml-file to 2.x so changeset version works with js-yaml 4

[tuyakhov]

What broke

The release workflow (release.yml) failed on pnpm run version → changeset version:

Error: Function yaml.safeLoad is removed in js-yaml 4. Use yaml.load instead, which is now safe by default.
    at Object.safeLoad (.../js-yaml@4.2.0/.../index.js)
    at parse (.../read-yaml-file@1.1.0/.../index.js)

The js-yaml >=4.2.0 override (added in #45 to clear an audit advisory) forced js-yaml 4 underneath read-yaml-file@1.1.0, which Changesets pulls in via @manypkg/get-packages@1.1.3. That old read-yaml-file calls the js-yaml 3 API yaml.safeLoad, removed in v4 — so versioning crashed.

ci.yml never caught this because it doesn't run changeset version; only release.yml does. As a result the merges of #44/#45 produced no published release — both changesets are still pending on main.

Fix

Override read-yaml-file to ^2.1.0. The 2.x line depends on js-yaml: ^4.0.0 and uses yaml.load, so it's compatible with the patched js-yaml. I pinned to ^2.1.0 (not 3.x) deliberately: read-yaml-file@3.0.0 is ESM-only ("type": "module"), which would break the CommonJS @manypkg/get-packages that require()s it; 2.1.0 is still CJS.

@changesets/cli is already at the latest (2.31.0) and still transitively pins @manypkg/get-packages@1.1.3 → read-yaml-file@1.1.0, so bumping Changesets doesn't help — the override is the targeted fix. The js-yaml >=4.2.0 override is kept (still needed to guarantee the patched js-yaml across the tree).

No changeset here: this only touches release/build tooling, not any published package's contents. The two existing pending changesets (blocked-message-status, audit-advisory-bumps) will be consumed once the release runs.

Verification

• pnpm run version (changeset version) → succeeds ("All files have been updated").
• pnpm audit --audit-level=moderate and --audit-level=high → no known vulnerabilities.
• pnpm install --frozen-lockfile, pnpm build, pnpm typecheck pass.
• pnpm test green — sdk 58, cli 80, react-email 29.
• Only read-yaml-file@2.1.0 remains in the tree (the stale 1.1.0 is gone).

🤖 Generated with Claude Code

---

Generated by Claude Code