[Snyk] Security upgrade js-yaml from 4.2.0 to 5.2.2

[caniszczyk]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• package.json
• yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Inefficient Algorithmic Complexity SNYK-JS-JSYAML-18313070	828

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[caniszczyk]

The upgrade from js-yaml v4 to v5 is a major version with significant breaking changes that require code modifications.

Key Breaking Changes:

• Module Imports: The package no longer has a default export. You must change how you import or require the library.

  • Before: const yaml = require('js-yaml'); yaml.load(...)
  • After (CommonJS): const { load } = require('js-yaml'); load(...)
  • After (ESM): import { load } from 'js-yaml'; load(...)

• Safe Loading by Default: The safeLoad(), safeLoadAll(), and safeDump() functions have been removed. The standard load(), loadAll(), and dump() functions are now safe by default and should be used as direct replacements.

• Default Schema Change: The default schema no longer supports merge keys (<<). If your YAML files use this feature, you will need to explicitly specify a schema that includes it.

• Stricter load() Behavior: Calling load() with an empty string now throws an error instead of returning undefined.

• Custom Types API: The API for defining custom types (new Type(...)) has been completely replaced by a new tags API.

Recommendation:
Developers must update import statements and replace calls to safeLoad/safeDump. Review any usage of merge keys (<<) or custom types, as they will require code changes to continue working. Thoroughly test all YAML parsing and serialization functionality after upgrading.

Source: v5 Migration Guide

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: caniszczyk

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f8c470cd-eb07-4bc7-8b4a-29d2d5e05b1e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch snyk-fix-21272c0195a21430a815d84fd7757bc4

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}