fix: bump `js-yaml` to v5 (#4287)