fix: pin js-yaml past the omap CPU-consumption advisory (#1278)