fix: override js-yaml to patched versions

[sbouchet]

What does this PR do?

This PR fixes CVE-2026-59869

js-yaml versions are updated to 3.15.0 and 4.3.0

What issues does this PR fix?

https://redhat.atlassian.net/browse/CRW-11824

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

• the PR contains changes in the code folder (you can skip it if your changes are placed in a che extension )
• the corresponding items were added to the CHANGELOG.md file
• rules for automatic git rebase were added to the .rebase folder

Summary by CodeRabbit

• Bug Fixes
  • Updated YAML parsing dependencies to newer supported versions across application components.
  • Added compatibility safeguards for components that still require the older YAML parser version.
  • Removed redundant dependency declarations and standardized dependency resolution.
• Chores
  • Updated dependency metadata and resolution overrides across development, remote, extension, launcher, and test components.
  • Added conflict-resolution handling for package updates.
  • Added the corresponding changelog entry.

[github-actions]

Click here to review and test in web IDE:

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-777-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-777-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-777-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-777-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-777-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-777-dev-amd64

[tolusha]

Hi! I'm che-ai-assistant — I help with your pull requests.

I check for new comments every 10m0s, so there may be a short delay before I respond.

Available commands:

• /che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
• /che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
• /che-ai-assistant ok-pr-readiness — Ensure PR has validation steps
• /che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
• /che-ai-assistant update-che-e2e-tests — Update Eclipse Che e2e tests
• /che-ai-assistant claude — Run a free-form instruction on this PR
• /che-ai-assistant help — Show this help message

[coderabbitai]

Warning

Review limit reached

@sbouchet, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ce59461e-519c-4580-bc23-5e45dc80a76f

📥 Commits

Reviewing files that changed from the base of the PR and between 057e1f8 and 3416c1a.

⛔ Files ignored due to path filters (1)

• code/extensions/copilot/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• .rebase/CHANGELOG.md
• code/extensions/copilot/package.json

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 20b351c8-a9a7-412a-bd9a-dede713cb5f2

📥 Commits

Reviewing files that changed from the base of the PR and between 35ab022 and 057e1f8.

⛔ Files ignored due to path filters (1)

• code/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (6)

• .rebase/CHANGELOG.md
• code/extensions/che-api/package.json
• code/extensions/che-commands/package.json
• code/extensions/che-github-authentication/package.json
• code/extensions/che-remote/package.json
• code/extensions/che-resource-monitor/package.json

💤 Files with no reviewable changes (1)

• .rebase/CHANGELOG.md

🚧 Files skipped from review as they are similar to previous changes (5)

• code/extensions/che-github-authentication/package.json
• code/extensions/che-resource-monitor/package.json
• code/extensions/che-commands/package.json
• code/extensions/che-remote/package.json
• code/extensions/che-api/package.json

---

📝 Walkthrough

Walkthrough

Updated js-yaml dependencies to ^4.3.1 across project packages. Added js-yaml 3.x and 4.x overrides where required. Removed redundant dependency declarations from rebase package manifests. Added conflict handling for the sanity package manifest in rebase.sh. Added a changelog entry.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to 057e1

The PR updates js-yaml to patched versions and adjusts the related dependency metadata; no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• che-incubator/che-code#744: Both PRs update dependency versions and npm overrides across the same package manifests, but for different packages.
• che-incubator/che-code#745: Both PRs update dependency overrides across overlapping package manifests and modify rebase.sh conflict handling, but target different packages.

Suggested reviewers: azatsarynnyy, rgrunber, vitaliy-guliy, romannikitenko

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise, uses imperative wording, and clearly describes the js-yaml override change.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Rebase Rules For Upstream Changes	✅ Passed	All required code package files have matching .rebase rules, a PR #777 CHANGELOG entry lists them, and rebase.sh routes each conflict, including the new sanity rule.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-777-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-777-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-777-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-777-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-777-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-777-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-777-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-777-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-777-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-777-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-777-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-777-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-777-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-777-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-777-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-777-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-777-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-777-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-777-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-777-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-777-dev-amd64