[Snyk] Security upgrade js-yaml from 4.1.1 to 4.3.2

[sestinj]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• extensions/cli/package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-JSYAML-19496768	828

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[sestinj]

This minor version upgrade for js-yaml addresses several security vulnerabilities related to inefficient algorithmic complexity.

Key Changes:

• Stricter Parsing: The update introduces stricter validation for merge keys (<<) and !!omap sequences to prevent potential Denial of Service (DoS) attacks. A maxTotalMergeKeys option has been backported to enforce limits. [1, 6, 7]
• Behavioral Impact: While most users will not be affected, applications that parse very large or complex YAML files with a high number of merge keys may now encounter parsing errors that did not occur previously. This change in behavior warrants verification against your specific use case.

No API methods have been removed or changed in this version range. The risk is assessed as medium due to the new, stricter parsing behavior introduced for security hardening.

Source: Changelog

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.