[Snyk] Security upgrade js-yaml from 3.15.0 to 5.2.2

[MaxMood96]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• packages/env/package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Inefficient Algorithmic Complexity SNYK-JS-JSYAML-18313070

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[MaxMood96]

This upgrade from js-yaml v3 to v5 spans two major versions and introduces significant breaking changes that require code modifications.

Key Breaking Changes:

• load() is Now Safe by Default: In v4, the unsafe load() function was deprecated in favor of safeLoad(). In v5, load() is now safe by default, behaving like the old safeLoad(). The potentially dangerous unsafe loading is now available via unsafeLoad(). Any code using the old load() for dynamic type construction will break.
• safe* Functions Removed: The aliases safeLoad(), safeLoadAll(), and safeDump() have been removed in v4. You must now use load(), loadAll(), and dump(), which are safe by default.
• Parsing Behavior Changes: The parser was updated to be compliant with the YAML 1.2 specification instead of 1.1. This changes how some values are interpreted, for example, 01234 is now a decimal number, and 1:23 is parsed as a string instead of a base-60 number.
• Custom Types API: The Type class for creating custom tags has been removed and replaced with a new API (defineScalarTag, defineSequenceTag, defineMappingTag).
• Dropped Node.js Support: Support for older, end-of-life Node.js versions (like 6, 8, and 10) was dropped across these major versions.

Source: Changelog, v5 Migration Guide

Recommendation: A thorough review and refactoring are required. All instances of safeLoad() must be renamed to load(). If your application relied on the old, unsafe load() behavior for features like reviving functions or regexes, you must switch to unsafeLoad() and ensure the input is trusted.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @snyk-bot, @MaxMood96, @mergify.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: snyk-bot, MaxMood96, mergify.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.