Unblock js-yaml 5 upgrade (waiting on @rollup/plugin-yaml)

[ramith]

What

js-yaml is pinned to the 4.x line. Dependabot is configured to skip its major bumps (.github/dependabot.yml, added in 27bf393); minor and patch updates still come through normally.

Why it's blocked

CVX loads YAML by two paths:

• Node export path — src/pdf/loadContent.js imports js-yaml directly.
• Browser/Vite preview path — parses through @rollup/plugin-yaml, which declares its own js-yaml dependency.

js-yaml 5 removed the CommonJS default export that @rollup/plugin-yaml relies on. Bumping only our direct dependency therefore splits the majors across those two paths, and the preview could parse YAML differently from the exported PDF.

test/deps.test.js ("js-yaml alignment across content-loading paths (R4)") guards exactly this. It caught the attempt in #3, failing on all 10 CI legs while the other 309 tests passed. The guard is working as designed — this is not a flake and not something to work around.

When it can be picked up

When @rollup/plugin-yaml ships support for js-yaml 5. Worth re-checking periodically:

npm view @rollup/plugin-yaml peerDependencies dependencies

What to do then

1. Remove the js-yaml ignore entry from .github/dependabot.yml.
2. Bump js-yaml and @rollup/plugin-yaml together.
3. Confirm test/deps.test.js passes — it verifies both paths resolve to the same major, either by dedupe or by matching nested copies.
4. Sanity-check that the browser preview and npx cvx build still agree on a CV containing YAML edge cases (multi-line strings, quoted specials, empty lists such as referees: []).

Alternatives, if upstream stays behind

• Drop @rollup/plugin-yaml and parse YAML in the browser path with the same js-yaml import the Node path uses, removing the second copy entirely — this deletes the whole class of problem, at the cost of a small Vite config change.
• Stay on js-yaml 4 indefinitely. It is not deprecated and has no known advisory; npm audit/osv-scanner are clean. There is no urgency here.

Context

Closed PR: #3
Guard: test/deps.test.js
Dependabot rule: 27bf393