Update js-yaml to 4.1.1

[JaclynCodes]

This pull request updates the js-yaml dependency from version 3.13.1 to 4.1.1 in both the sync-ghes and validate-data scripts. As part of this upgrade, related dependencies are updated, and unused transitive dependencies are removed, resulting in a cleaner dependency tree and better compatibility with newer Node.js versions.

Dependency upgrades and cleanup:

• Upgraded js-yaml from ^3.13.1 to ^4.1.1 in both script/sync-ghes/package.json and script/validate-data/package.json, as well as their respective package-lock.json files. [1] [2] [3] [4]
• Updated argparse dependency from version 1.0.10 to 2.0.1, reflecting changes in the dependency tree for both scripts. [1] [2] [3] [4]
• Removed esprima and sprintf-js as transitive dependencies, which are no longer required by the updated version of js-yaml and argparse. [1] [2] [3] [4] [5] [6] [7] [8]

These changes improve security and maintainability by keeping dependencies up to date and removing unnecessary packages.<!--
IMPORTANT:

This repository contains configuration for what users see when they click on the Actions tab and the setup page for Code Scanning.

It is not:

• A playground to try out scripts
• A place for you to create a workflow for your repository
  -->

Pre-requisites

• Prior to submitting a new workflow, please apply to join the GitHub Technology Partner Program: partner.github.com/apply.

---

Please note that at this time we are only accepting new starter workflows for Code Scanning. Updates to existing starter workflows are fine.

---

Tasks

For all workflows, the workflow:

• Should be contained in a .yml file with the language or platform as its filename, in lower, kebab-cased format (for example, docker-image.yml). Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").
• Should use sentence case for the names of workflows and steps (for example, "Run tests").
• Should be named only by the name of the language or platform (for example, "Go", not "Go CI" or "Go Build").
• Should include comments in the workflow for any parts that are not obvious or could use clarification.
• Should specify least privileged permissions for GITHUB_TOKEN so that the workflow runs successfully.

For CI workflows, the workflow:

• Should be preserved under the ci directory.
• Should include a matching ci/properties/*.properties.json file (for example, ci/properties/docker-publish.properties.json).
• Should run on push to branches: [ $default-branch ] and pull_request to branches: [ $default-branch ].
• Packaging workflows should run on release with types: [ created ].
• Publishing workflows should have a filename that is the name of the language or platform, in lower case, followed by "-publish" (for example, docker-publish.yml).

For Code Scanning workflows, the workflow:

• Should be preserved under the code-scanning directory.
• Should include a matching code-scanning/properties/*.properties.json file (for example, code-scanning/properties/codeql.properties.json), with properties set as follows:
  • name: Name of the Code Scanning integration.
  • creator: Name of the organization/user producing the Code Scanning integration.
  • description: Short description of the Code Scanning integration.
  • categories: Array of languages supported by the Code Scanning integration.
  • iconName: Name of the SVG logo representing the Code Scanning integration. This SVG logo must be present in the icons directory.
• Should run on push to branches: [ $default-branch, $protected-branches ] and pull_request to branches: [ $default-branch ]. We also recommend a schedule trigger of cron: $cron-weekly (for example, codeql.yml).

Some general notes:

• This workflow must only use actions that are produced by GitHub, in the actions organization, or
• This workflow must only use actions that are produced by the language or ecosystem that the workflow supports. These actions must be published to the GitHub Marketplace. We require that these actions be referenced using the full 40 character hash of the action's commit instead of a tag. Additionally, workflows must include the following comment at the top of the workflow file:

  # This workflow uses actions that are not certified by GitHub.
  # They are provided by a third-party and are governed by
  # separate terms of service, privacy policy, and support
  # documentation.
  

• Automation and CI workflows should not send data to any 3rd party service except for the purposes of installing dependencies.
• Automation and CI workflows cannot be dependent on a paid service or product.

[Copilot]

Pull Request Overview

This PR updates the js-yaml dependency from version 3.13.1 to 4.1.1 in both the sync-ghes and validate-data scripts, along with related dependency updates. However, this PR is incomplete and will cause runtime failures because it does not update the code to handle breaking API changes introduced in js-yaml 4.x (specifically, safeLoad has been removed and replaced with load).

Key Changes

• Upgraded js-yaml from ^3.13.1 to ^4.1.1 in both scripts' package.json files
• Updated argparse dependency from 1.0.10 to 2.0.1 (transitive dependency of js-yaml)
• Removed esprima and sprintf-js packages that are no longer needed by js-yaml 4.x

Reviewed Changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 2 comments.

File	Description
script/validate-data/package.json	Updated js-yaml version to 4.1.1, but missing required code changes for breaking API
script/validate-data/package-lock.json	Updated lockfile with new js-yaml 4.1.1, argparse 2.0.1, and removed obsolete dependencies
script/sync-ghes/package.json	Updated js-yaml version to 4.1.1, but missing required code changes for breaking API
script/sync-ghes/package-lock.json	Updated lockfile with new js-yaml 4.1.1, argparse 2.0.1, and removed obsolete dependencies

Files not reviewed (2)

• script/sync-ghes/package-lock.json: Language not supported
• script/validate-data/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[JaclynCodes]

@JaclynCodes

[JaclynCodes]

@JaclynCodes