[DEPENDENCY] Bump js-yaml from 3.14.1 to 4.0.0 (#380)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Matthias Osswald <mat.osswald@sap.com>

lib/projectPreprocessor.js

@@ -412,12 +412,8 @@ class ProjectPreprocessor {
 		let configs;
 
 		try {
-			// Using loadAll with DEFAULT_SAFE_SCHEMA instead of safeLoadAll to pass "filename".
-			// safeLoadAll doesn't handle its parameters properly.
-			// See https://github.com/nodeca/js-yaml/issues/456 and https://github.com/nodeca/js-yaml/pull/381
 			configs = jsyaml.loadAll(configFile, undefined, {
-				filename: configPath,
-				schema: jsyaml.DEFAULT_SAFE_SCHEMA
+				filename: configPath
 			});
 		} catch (err) {
 			if (err.name === "YAMLException") {

lib/translators/static.js

@@ -2,7 +2,7 @@ const path = require("path");
 const fs = require("graceful-fs");
 const {promisify} = require("util");
 const readFile = promisify(fs.readFile);
-const parseYaml = require("js-yaml").safeLoad;
+const parseYaml = require("js-yaml").load;
 
 function resolveProjectPaths(project) {
 	project.path = path.resolve(project.path);

package.json

@@ -109,7 +109,7 @@
 		"chalk": "^4.1.0",
 		"escape-string-regexp": "^4.0.0",
 		"graceful-fs": "^4.2.6",
-		"js-yaml": "^3.14.1",
+		"js-yaml": "^4.0.0",
 		"libnpmconfig": "^1.2.1",
 		"lockfile": "^1.0.4",
 		"mkdirp": "^1.0.4",