chore(deps-dev): bump js-yaml from 5.2.3 to 5.3.0

[dependabot]

Bumps js-yaml from 5.2.3 to 5.3.0.

Changelog

Sourced from js-yaml's changelog.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

Added

• Added completely new documentation.
• Exported DUMP_SCHEMA, the default schema used by the dumper.
• Added YAMLException.throwAt() for throwing an error at a source position.

Changed

• Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE, COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old exports are still preserved, but deprecated.
• Made identify mandatory for custom tag definitions. Use identify: () => false for load-only tags.

Deprecated

• Deprecated flat constant exports. Use grouped ones instead.

Removed

• Removed the MERGE_KEY export (not used anymore after last fixes).

Fixed

• Validate << sequence items at merge time, so aliased merge sources are checked too.
• Resolve << outside of a mapping key as the plain string '<<', matching v4, instead of leaking an internal symbol into the result.

Commits

• 04db458 5.3.0 released
• 22ce0a0 Changelog update
• fae37b8 fix: << outside a mapping key no longer leaks the internal merge symbol
• b62ef83 fix: validate << sequence items at merge time, so aliased sources are check...
• cc665ec docs: review and update annotations
• 2aa24a6 Changelog update
• eec6902 Restore deprecated parser constant exports
• 03397ac Move throwErrorAt to YAMLException as throwAt
• d9dd2c7 docs: new condensed theme
• 0f898e6 docs: annotation tweaks
• Additional commits viewable in compare view

[github-actions]

Tagging @rajbos for notifications

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 6789304.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
npm/js-yaml	5.3.0	🟢 6	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 26 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo SAST ⚠️ 0 no SAST tool detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 4 security policy file detected

Scanned Files

• package-lock.json