fix: migrate to js-yaml v5

[DmitryAnansky]

What/Why/How?

Upgraded js-yaml from v4 to v5. This fixes bundling of strings that look like numbers with underscores (e.g. '12_34'): they are now kept quoted in YAML output instead of being emitted unquoted and read back as numbers by YAML 1.1 parsers.

Breaking change: js-yaml v5 parses YAML more strictly. A multi-line flow collection whose closing bracket is indented to (or below) the level of its parent key is now a parse error. For example, this no longer parses and must be reindented:

example: { 'a': 'test' } # <- move the closing brace to the right of `example:`

All other scalar resolution (hex/octal/leading-zero integers, capitalized booleans, ~ as null, dates kept as strings) and the handling of empty/comment-only documents are unchanged.

Reference

#2906

Alternative

#2907

Testing

Screenshots (optional)

Check yourself

• This PR follows the contributing guide
• All new/updated code is covered by tests
• Core code changed? - Tested with other Redocly products (internal contributions only)
• New package installed? - Tested in different environments (browser/node)
• Documentation update has been considered

Security

• The security impact of the change has been considered
• Code follows company security practices and guidelines

---

Note

Medium Risk
Core YAML parse/stringify affects all lint, bundle, and config loading; stricter parsing can break previously accepted OpenAPI YAML, though underscore-number bundling is a targeted fix.

Overview
Upgrades js-yaml from 4.2.0 to 5.2.1 in @redocly/openapi-core and adapts the YAML wrapper to the v5 API (CORE_SCHEMA.withTags, loadAll with single-document enforcement, and explicit handling of empty vs comment-only input). @types/js-yaml is dropped because v5 ships its own types.

Bundled YAML output now keeps values like 12_34 quoted so they round-trip as strings instead of being emitted as bare numbers. E2E coverage was added for that behavior.

Breaking: v5 parses YAML more strictly—multi-line flow collections whose closing }/] is not indented deeper than the parent key now fail to parse. Parse errors also point at the offending token (test snapshots updated) rather than the end of the file.

^{Reviewed by Cursor Bugbot for commit e777d9d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: e777d9d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@redocly/openapi-core	Patch
@redocly/cli	Patch
@redocly/respect-core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	70.42% (🎯 69%)	7786 / 11056
🔵	Statements	70.11% (🎯 69%)	8102 / 11555
🔵	Functions	74.8% (🎯 73%)	1562 / 2088
🔵	Branches	62.02% (🎯 61%)	5255 / 8472

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/core/src/js-yaml/index.ts	100%	100%	100%	100%

Generated in workflow #10743 for commit e777d9d by the Vitest Coverage Report Action

[github-actions]

📦 A new experimental 🧪 version v0.0.0-snapshot.1782145948 of Redocly CLI has been published for testing.

Install with NPM:

npm install @redocly/cli@0.0.0-snapshot.1782145948

⚠️ Note: This is a development build and may contain unstable features.

[tatomyr]

Please test this in the VSCE.

[DmitryAnansky]

@vadyvas please take a look.

[DmitryAnansky]

Performance Benchmark fails due to indentation, already notified the OAS description owners.

[github-actions]

📦 A new experimental 🧪 version v0.0.0-snapshot.1782209756 of Redocly CLI has been published for testing.

Install with NPM:

npm install @redocly/cli@0.0.0-snapshot.1782209756

⚠️ Note: This is a development build and may contain unstable features.

[github-actions]

Performance Benchmark (Lower is Faster)

CLI Version	Bundle	Lint	Check Config
cli-latest	▓ 1.00x (Fastest)	▓ 1.00x (Fastest)	▓ 1.00x (Fastest)
cli-next	▓▓▓ 1.08x ± 0.01	▓ 1.02x ± 0	▓ 1.01x ± 0.01

Warning

This PR may introduce a performance regression vs the latest released version:

• Bundle: 8.0% slower

[github-actions]

📦 A new experimental 🧪 version v0.0.0-snapshot.1784280563 of Redocly CLI has been published for testing.

Install with NPM:

npm install @redocly/cli@0.0.0-snapshot.1784280563

⚠️ Note: This is a development build and may contain unstable features.

[vadyvas]

internal: e2e, vs-code