[Snyk] Security upgrade js-yaml from 4.1.0 to 4.3.0

[posit-snyk-bot]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• extensions/positron-dev-containers/package.json
• extensions/positron-dev-containers/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Inefficient Algorithmic Complexity SNYK-JS-JSYAML-17900054	227

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[posit-snyk-bot]

This is a minor version upgrade for js-yaml that introduces security enhancements and bug fixes without any documented breaking changes.

Key Changes:

• Version 4.2.0: Introduced new loader options (maxDepth, maxTotalMergeKeys, maxAliases) to enhance security and prevent potential Denial of Service (DoS) attacks from maliciously crafted YAML files. These are additive features and should not impact existing implementations.
• Version 4.3.0: Includes a bug fix for a performance regression related to ordered maps (!!omap).

No APIs were removed or altered in a breaking way within the 4.1.0 to 4.3.0 range. The upgrade is recommended for its security improvements.

Source: GitHub CHANGELOG.md

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[github-actions]

E2E Tests 🚀
This PR will run tests tagged with: @:critical

Note

No feature tags detected. If this PR needs feature coverage, add the tag above and retrigger the workflow.

^{readme  valid tags}

[juliasilge]

@jmcphers, can you evaluate if we should take this version bump?