Update js-yaml to 4.1.1

[evman182]

GHSA-mh29-5h37-fv8m

fixes: #970

[CLAassistant]

All committers have signed the CLA.

[cypress-app-bot]

• Create a Draft Pull Request if your PR is not ready for review. Mark the PR as Ready for Review when you're ready for a Cypress team member to review the PR.

[jpage-godaddy]

Maybe we could also make this more future-proof? Not sure why we have ^ versioning for some but not all dependencies.

Suggested change

	"js-yaml": "4.1.1",
	"js-yaml": "^4.1.1",

[fyodorio]

Taking into account the recent amount of npm supply chain vulnerabilities where unsolicited (and vulnerable) patch versions caused drastic mayhem, I would highly recommend the opposite — switching to strict dependency package versioning.

[woody-li]

@fyodorio
I think using strict package version is a good way.
But it requires more timely maintenance to upgrade the dependency versions.

This vulnerability issue was reported at Nov 13, 2025
But the dependency upgrade is still in progress for now (almost 3 months).

[jlocke2]

@jpage-godaddy @AtofStryker @jennifer-shehane - Apologies for the ping (not sure who the right person would be in this case), but would it be possible to review/merge this change as it relates to GHSA-mh29-5h37-fv8m. Happy to help if needed.