fix: override js-yaml to patched versions

[sbouchet]

What does this PR do?

This PR fixes CVE-2026-59869

js-yaml versions are updated to 3.15.0 and 4.3.0

What issues does this PR fix?

https://redhat.atlassian.net/browse/CRW-11824

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

• the PR contains changes in the code folder (you can skip it if your changes are placed in a che extension )
• the corresponding items were added to the CHANGELOG.md file
• rules for automatic git rebase were added to the .rebase folder

Summary by CodeRabbit

• Bug Fixes
  • Updated YAML parsing dependencies to newer supported versions across application components.
  • Added compatibility safeguards for components that still require the older YAML parser version.
  • Removed redundant dependency declarations and standardized dependency resolution.
• Chores
  • Updated dependency metadata and resolution overrides across development, remote, extension, launcher, and test components.
  • Added conflict-resolution handling for package updates.
  • Added the corresponding changelog entry.

[github-actions]

Click here to review and test in web IDE:

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-777-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-777-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-777-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-777-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-777-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-777-dev-amd64

[tolusha]

Hi! I'm che-ai-assistant — I help with your pull requests.

I check for new comments every 10m0s, so there may be a short delay before I respond.

Available commands:

• /che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
• /che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
• /che-ai-assistant ok-pr-readiness — Ensure PR has validation steps
• /che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
• /che-ai-assistant update-che-e2e-tests — Update Eclipse Che e2e tests
• /che-ai-assistant claude — Run a free-form instruction on this PR
• /che-ai-assistant help — Show this help message

[coderabbitai]

Warning

Review limit reached

@sbouchet, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 57 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fb3d6111-b93e-4f74-9882-5677094c517f

📥 Commits

Reviewing files that changed from the base of the PR and between 35ab022 and 13e5f3a.

📒 Files selected for processing (1)

• .rebase/CHANGELOG.md

📝 Walkthrough

Walkthrough

Updated js-yaml dependencies to ^4.3.1 across project packages. Added js-yaml 3.x and 4.x overrides where required. Removed redundant dependency declarations from rebase package manifests. Added conflict handling for the sanity package manifest in rebase.sh. Added a changelog entry.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• che-incubator/che-code#756: Updates js-yaml dependencies through vulnerability remediation and Dependabot workflows.
• che-incubator/che-code#722: Updates dependency overrides across overlapping manifests and rebase handling.
• che-incubator/che-code#771: Pins another dependency across overlapping manifests and rebase handling.

Suggested reviewers: rgrunber, azatsarynnyy, vitaliy-guliy, romannikitenko

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Rebase Rules For Upstream Changes	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise, uses imperative mood, and clearly describes the js-yaml version override changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-777-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-777-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-777-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-777-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-777-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-777-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-777-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-777-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-777-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-777-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-777-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-777-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-777-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-777-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-777-dev-amd64