[Snyk] Security upgrade js-yaml from 4.3.0 to 5.2.2

[posit-snyk-bot]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• apps/vscode-markdownit/package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Inefficient Algorithmic Complexity SNYK-JS-JSYAML-18313070	227

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[posit-snyk-bot]

This is a major version upgrade from v4 to v5 which introduces significant breaking changes. A thorough review and code modifications are required before merging.

Key Breaking Changes:

• Module Imports: The package has been rewritten and no longer uses a default export. Code must be updated to use named imports. For example, const yaml = require('js-yaml') must be changed to const { load, dump } = require('js-yaml') for CommonJS, or import { load, dump } from 'js-yaml' for ES Modules.
• Removed Functions: The safeLoad(), safeLoadAll(), and safeDump() functions have been removed. The standard load(), loadAll(), and dump() functions are now safe by default and should be used instead.
• Error on Empty Input: load() will now throw an error when parsing an empty string, whereas it previously returned undefined. Code that relies on the old behavior must be updated.
• Schema and Type Changes: The default schema has changed to CORE_SCHEMA (YAML 1.2), which does not include support for the merge key (<<) feature by default. The API for creating custom types has also been completely rewritten.
• Number Parsing: Number parsing now follows the YAML 1.2 specification, which means strings like 0123 are parsed as decimal numbers, not octal.

Source: Migration Guide v4 to v5, Changelog

Recommendation: Developers must carefully follow the official migration guide to update import statements, function calls, and handle schema changes. This is a high-effort migration that requires significant code refactoring.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.