chore: bump js-yaml version COMPASS-10911

[dudaschar]

Description

Checklist

• New tests and/or benchmarks are included
• Documentation is changed or added
• If this change updates the UI, screenshots/videos are added and a design review is requested
• If this change could impact the load on the MongoDB cluster, please describe the expected and worst case impact
• I have signed the MongoDB Contributor License Agreement (https://www.mongodb.com/legal/contributor-agreement)

Motivation and Context

• Bugfix
• New feature
• Dependency update
• Misc

Open Questions

Dependents

Types of changes

• Backport Needed
• Patch (non-breaking change which fixes an issue)
• Minor (non-breaking change which adds functionality)
• Major (fix or feature that would cause existing functionality to change)

[Copilot]

Pull request overview

This PR updates the monorepo’s js-yaml dependency to a newer major version across the root and several workspaces. The main review concern is dependency compatibility: packages/bson-transpilers currently relies on js-yaml-js-types, which declares a peer dependency on js-yaml@4.x, making the bump to js-yaml@^5.2.2 likely to cause install-time peer resolution failures and/or runtime incompatibilities.

Changes:

• Bumped js-yaml from ^4.3.0 to ^5.2.2 in the root and multiple workspace package.json files.
• Updated package-lock.json to reflect the new js-yaml version and resolved dependency tree.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
packages/hadron-build/package.json	Bumps js-yaml dependency version.
packages/compass-preferences-model/package.json	Bumps js-yaml dependency version.
packages/bson-transpilers/package.json	Bumps js-yaml dependency version (conflicts with js-yaml-js-types peer requirement).
package.json	Bumps root js-yaml devDependency version.
package-lock.json	Updates lockfile to js-yaml@5.2.2 and related entries.

[gribnoysup]

This is pulling "affected" version as a transitive dep of a package we own, so you'd have to update it also (I think this package is in devtools-shared repo)

[dudaschar]

nice, I'll update there as well.

[dudaschar]

We still have this version because the mcp repo is depending on the old mongodb-schema. I'll update there as well.