[luojiyin1987]

What changed

• Replace the global js-yaml override with a targeted override for @istanbuljs/load-nyc-config.
• Resolve js-yaml@4.3.2 and argparse@2.0.1.
• Remove sprintf-js from the dependency tree.

Before:

@istanbuljs/load-nyc-config@1.1.0
└─ js-yaml@3.15.2
   └─ argparse@1.0.10
      └─ sprintf-js@1.0.3

After:

@istanbuljs/load-nyc-config@1.1.0
└─ js-yaml@4.3.2
   └─ argparse@2.0.1

Why

npm audit reported 20 moderate vulnerabilities.
All 20 came from sprintf-js@1.0.3 (GHSA-hp3w-g68c-fv3c).
sprintf-js has no fixed release: the advisory covers <=1.1.3, and 1.1.3 is the latest version.

js-yaml@4 depends on argparse@2, which does not use sprintf-js.
@istanbuljs/load-nyc-config only calls js-yaml.load() for .yml and .yaml files.
load() exists in v4.

This chain is dev-only.
npm audit --omit=dev was already 0, and the published package does not include it.

Verification

• npm audit reports 0 vulnerabilities.
• npm audit --omit=dev reports 0 vulnerabilities.
• npm ls sprintf-js is empty.
• npm test passes: 27 suites and 238 tests.
• npm run lint passes.
• npm run test:package passes.
• js-yaml CLI runs without deprecation warnings.

Closes #203.