Fix CVE-2026-84375 by updating js-yaml to patched versions

[sbouchet]

What does this PR do?

This PR fixes CVE-2026-84375
js-yaml versions are updated to 4.3.2 and 3.15.2

What issues does this PR fix?

https://redhat.atlassian.net/browse/CRW-12788

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

• the PR contains changes in the code folder (you can skip it if your changes are placed in a che extension )
• the corresponding items were added to the CHANGELOG.md file
• rules for automatic git rebase were added to the .rebase folder

Summary by CodeRabbit

• Chores
  • Updated YAML parsing dependencies to newer 3.x and 4.x patch versions across application components and extensions.
  • Added coverage for both supported dependency versions where applicable.
• Style
  • Applied minor formatting consistency updates in package configuration files.
• Documentation
  • Recorded the dependency updates in the project changelog.

[github-actions]

Click here to review and test in web IDE:

[coderabbitai]

Warning

Review limit reached

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: che-incubator/che-code/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 1cee97d2-43e4-4e2c-92fe-664b5c15a230

📥 Commits

Reviewing files that changed from the base of the PR and between 411cd93 and eb296ea.

⛔ Files ignored due to path filters (14)

• code/build/package-lock.json is excluded by !**/package-lock.json
• code/extensions/che-api/package-lock.json is excluded by !**/package-lock.json
• code/extensions/che-commands/package-lock.json is excluded by !**/package-lock.json
• code/extensions/che-github-authentication/package-lock.json is excluded by !**/package-lock.json
• code/extensions/che-port/package-lock.json is excluded by !**/package-lock.json
• code/extensions/che-remote/package-lock.json is excluded by !**/package-lock.json
• code/extensions/che-resource-monitor/package-lock.json is excluded by !**/package-lock.json
• code/extensions/che-terminal/package-lock.json is excluded by !**/package-lock.json
• code/extensions/copilot/package-lock.json is excluded by !**/package-lock.json
• code/extensions/npm/package-lock.json is excluded by !**/package-lock.json
• code/package-lock.json is excluded by !**/package-lock.json
• code/remote/package-lock.json is excluded by !**/package-lock.json
• code/test/sanity/package-lock.json is excluded by !**/package-lock.json
• launcher/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (21)

• .rebase/CHANGELOG.md
• .rebase/add/code/build/package.json
• .rebase/add/code/extensions/npm/package.json
• .rebase/add/code/package.json
• .rebase/add/code/remote/package.json
• .rebase/add/code/test/sanity/package.json
• .rebase/override/code/extensions/copilot/package.json
• code/build/package.json
• code/extensions/che-api/package.json
• code/extensions/che-commands/package.json
• code/extensions/che-github-authentication/package.json
• code/extensions/che-port/package.json
• code/extensions/che-remote/package.json
• code/extensions/che-resource-monitor/package.json
• code/extensions/che-terminal/package.json
• code/extensions/copilot/package.json
• code/extensions/npm/package.json
• code/package.json
• code/remote/package.json
• code/test/sanity/package.json
• launcher/package.json

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 25b5bf6b-a8bf-4c81-a0c3-a6b31fb4dfcc

📥 Commits

Reviewing files that changed from the base of the PR and between 1d86a6d and 411cd93.

⛔ Files ignored due to path filters (14)

• code/build/package-lock.json is excluded by !**/package-lock.json
• code/extensions/che-api/package-lock.json is excluded by !**/package-lock.json
• code/extensions/che-commands/package-lock.json is excluded by !**/package-lock.json
• code/extensions/che-github-authentication/package-lock.json is excluded by !**/package-lock.json
• code/extensions/che-port/package-lock.json is excluded by !**/package-lock.json
• code/extensions/che-remote/package-lock.json is excluded by !**/package-lock.json
• code/extensions/che-resource-monitor/package-lock.json is excluded by !**/package-lock.json
• code/extensions/che-terminal/package-lock.json is excluded by !**/package-lock.json
• code/extensions/copilot/package-lock.json is excluded by !**/package-lock.json
• code/extensions/npm/package-lock.json is excluded by !**/package-lock.json
• code/package-lock.json is excluded by !**/package-lock.json
• code/remote/package-lock.json is excluded by !**/package-lock.json
• code/test/sanity/package-lock.json is excluded by !**/package-lock.json
• launcher/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (21)

• .rebase/CHANGELOG.md
• .rebase/add/code/build/package.json
• .rebase/add/code/extensions/npm/package.json
• .rebase/add/code/package.json
• .rebase/add/code/remote/package.json
• .rebase/add/code/test/sanity/package.json
• .rebase/override/code/extensions/copilot/package.json
• code/build/package.json
• code/extensions/che-api/package.json
• code/extensions/che-commands/package.json
• code/extensions/che-github-authentication/package.json
• code/extensions/che-port/package.json
• code/extensions/che-remote/package.json
• code/extensions/che-resource-monitor/package.json
• code/extensions/che-terminal/package.json
• code/extensions/copilot/package.json
• code/extensions/npm/package.json
• code/package.json
• code/remote/package.json
• code/test/sanity/package.json
• launcher/package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Updated package manifests to require js-yaml ^4.3.2 and, where applicable, js-yaml 3.x ^3.15.2. Applied the updates to active and rebase manifests. Added a changelog entry for PR 813. Two package files also contain formatting-only changes.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 411cd

The dependency updates are consistent with the recorded package resolutions and introduce no identified merge-blocking risk.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Rebase Rules For Upstream Changes	❌ Error	The PR changes six in-scope files under code/. The required .rebase/ rules, changelog entry, and rebase.sh routing are present. However, the PR description leaves the changelog checklist item un…	Change the changelog checklist item in the PR description to - [x] the corresponding items were added to the CHANGELOG.md file.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is 58 characters, uses the imperative verb "Fix," and clearly describes the js-yaml security update for CVE-2026-84375.

Full details: Rebase Rules For Upstream Changes

Explanation

The PR changes six in-scope files under code/. The required .rebase/ rules, changelog entry, and rebase.sh routing are present. However, the PR description leaves the changelog checklist item unchecked (- [ ]). The check requires all three checklist items to be checked when code/ files change.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-813-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-813-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-813-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-813-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-813-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-813-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-813-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-813-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-813-dev-amd64

[RomanNikitenko]

Looks good to me, I didn't find any problem!