Allow compatible js-yaml patch updates

js-yaml is currently pinned exactly:

"js-yaml": "=4.3.1"

This prevents consumers from receiving compatible security patch releases.

For example, GHSA-2883-xcg3-v3hh is fixed in js-yaml 4.3.2, but npm/Dependabot cannot update to it because Swagger UI requires exactly 4.3.1. As a result, the vulnerability remains in downstream projects until Swagger UI publishes another release.

This has happened with previous js-yaml security fixes as well, and js-yaml has had multiple security advisories over time, so exact pinning makes this a recurring problem.

Is there a reason js-yaml cannot use a compatible v4 range, e.g. ^4.3.2?