chore(deps): bump js-yaml from 4.3.1 to 5.2.3 in /backend

[dependabot]

Bumps js-yaml from 4.3.1 to 5.2.3.

Changelog

Sourced from js-yaml's changelog.

[5.2.3] - 2026-08-01

Fixed

• Prevent prototype fallback when resolving tags and mapping entries, #782.
• Resolve !!timestamp years 0000-0099 correctly, #775.
• Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.
• Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

[5.2.2] - 2026-07-24

Fixed

• Quote flow scalars where a colon precedes a flow indicator, #773.

Security

• Avoid exponential parsing time for nested flow sequence pairs.

[5.2.1] - 2026-07-02

Fixed

• Add Map support to !!omap (should work when realMapTag used)

Security

• Remove quadratic complexity from !!omap addItem. Regression from v5 (usually not critical, because YAML11_SCHEMA is not default anymore).

4.3.0, 3.15.0 - 2026-06-27

Security

• Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
• Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

• maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

• Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

... (truncated)

Commits

• 6740445 5.2.3 released
• 94e766d Update changelog
• c3bd7ca Polish previous commit, #780
• 00209b6 presenter: treat a tab-indented line in a folded scalar as more-indented (#780)
• 40fcb4f Fix missing mapping values before document markers and reject unpaired mappin...
• 49280f3 Fix !!timestamp resolution for years 0000-0099, #775
• 355dc96 fix: prevent prototype fallback in tag and harden object lookups, #782 (than...
• d524f83 docs: add contributing guidelines
• 3c29559 5.2.2 released
• 3e5240f parser: avoid reparsing flow sequence pair keys
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
tzudong	Ignored	Preview	Aug 7, 2026 3:42am

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4d2a36fa71

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Preserve the default export used by the map crawler

When 05-map-url-crawling.js starts a map crawl, loadChannelsConfig() uses const { default: yaml } = await import('js-yaml'), but js-yaml 5's ESM entry exposes the API through named exports rather than that default object. Consequently yaml is undefined and the subsequent yaml.load(config) aborts every map-URL crawl before processing begins; update this caller to use the named load export (as the transcript crawler already does) as part of the major-version upgrade.

Useful? React with 👍 / 👎.

[dependabot]

Superseded by #2496.