[@vercel/python-analysis] Bump js-yaml to 4.3.2 for CVE-2026-84375

@vercel/python-analysis pins js-yaml exactly to 4.1.1, including in the latest published 0.14.0 release and current public main (published package, manifest). This version is affected by GHSA-2883-xcg3-v3hh / CVE-2026-84375, a CPU-exhaustion issue involving repeated empty YAML merge sources; the patched 4.x release is 4.3.2.

Could you update the pin to 4.3.2 and publish a patched @vercel/python-analysis release, followed by the dependent Vercel packages? Updating to the currently published parent version does not resolve the transitive dependency, and  vercel/vercel#17575 leaves the 4.1.1 pin unchanged.

This is separate from #17380, which tracks the older merge-chain advisory for @vercel/frameworks. The upstream fix is merged in  nodeca/js-yaml#797, and 4.3.2 is released.

I’m requesting a dependency update, not claiming a demonstrated exploitable path through Vercel CLI. In the @vercel/[email protected] version I reviewed, the YAML branch exists in a generic config helper, but its production callers use TOML or JSON files (helper, call sites).