[huntharo]

Remove the unpatched sprintf-js dependency reached through Jest's NYC configuration loader. A parent-scoped pnpm override moves only @istanbuljs/load-nyc-config to js-yaml@4.3.2, retaining the loader's load() API and replacing the legacy argparse 1 dependency path.

The frozen lock removes the obsolete YAML 3, argparse 1, and sprintf-js records. The seven-day release age, APFS import mode, and build-script restrictions are preserved; YAML 4.3.2 was published August 26 and passed pnpm's supply-chain validation.

Validation on Node 24.21.0 / pnpm 12.7.0: fresh frozen install; all 106 tests / 8 suites; build, lint, and docs (one existing Errors warning). Focused checks exercise real NYC YAML configuration with includes/excludes, inheritance and camel-case options, plus YAML CLI input/help/version.

Current October 22 audit changes from six findings to five: sprintf-js is gone. The remaining three Handlebars findings are covered by #36. The other two are markdown-it findings; patched 14.3.3 becomes eligible under the unchanged seven-day policy at 2026-10-23 01:47:54.675 UTC (October 22, 9:47 PM EDT). This PR does not claim a clean audit or replace #36. Mermaid-specific findings on the 2.x branches are being handled separately.

[github-actions]

📊 Node.js Code Coverage Report

File	Lines	Lines Hit / Found	Uncovered Lines	Branches
src/blocking-queue.ts	✅ 100.0%	227 / 227	0	100.0%
src/index.ts	✅ 100.0%	33 / 33	0	100.0%
src/iterable-mapper.ts	✅ 100.0%	564 / 564	0	100.0%
src/iterable-queue-mapper-simple.ts	✅ 100.0%	162 / 162	0	100.0%
src/iterable-queue-mapper.ts	✅ 100.0%	110 / 110	0	100.0%
src/iterable-queue.ts	✅ 100.0%	43 / 43	0	100.0%
src/queue.ts	✅ 100.0%	35 / 35	0	100.0%
Overall	✅ 100.0%	1174 / 1174	0	100.0%