Update js-yaml and qs to patched versions

[Sean McManus (sean-mcmanus)]

Summary

• Update js-yaml from 4.3.1 to 4.3.2 in the Actions, Extension, ExtensionPack, and Themes lockfiles to address GHSA-2883-xcg3-v3hh.
• Update qs from 6.15.2 to 6.16.0 in the Extension, ExtensionPack, and Themes lockfiles to address GHSA-x5fp-wj9c-mxmx and GHSA-4mjr-xmp4-gh2g, including its required side-channel updates.
• Keep all manifest dependency ranges unchanged: @vscode/vsce 3.9.2 already permits the patched qs through typed-rest-client. Verify SHA-512 integrity for the updated packages.

This PR was investigated and created by GitHub Copilot (in VS Code). Any message starting with ✨Copilot: was sent by Copilot.

Validation

• npm ci --ignore-scripts and npm audit in .github/actions, ExtensionPack, and Themes; all three audits report zero vulnerabilities.
• Frozen Yarn install, yarn audit, yarn test-yarn-lock, and yarn verify-yarn-lock in Extension; its audit reports zero vulnerabilities.
• Extension compilation and lint.
• Bounded old-versus-patched regression probes for the empty-merge budget and both qs advisories.
• Verified updated tarball hashes, unchanged lockfiles after installation, and git diff --check.

[Copilot]

🟢 Approval recommended

The lockfile updates consistently replace the vulnerable versions (no remaining js-yaml@4.3.1/qs@6.15.2 entries in the changed lockfiles) and include the expected transitive dependency adjustments.

Pull request overview

This PR updates transitive dependency lockfiles to pull in patched versions of js-yaml and qs (plus required side-channel-chain updates) to remediate the referenced GitHub Security Advisories, without changing any manifest dependency ranges.

Changes:

• Bump js-yaml from 4.3.1 to 4.3.2 in npm and Yarn lockfiles.
• Bump qs from 6.15.2 to 6.16.0, including updated side-channel/side-channel-list/object-inspect and newly required es-define-property in the affected lockfiles.
• Update resolved/integrity entries to match the new tarballs.

File summaries

File	Description
Themes/package-lock.json	Updates js-yaml and qs (and transitive deps) to patched versions.
ExtensionPack/package-lock.json	Updates js-yaml and qs (and transitive deps) to patched versions.
Extension/yarn.lock	Updates js-yaml, qs, and side-channel-chain entries to patched versions and adds es-define-property.
.github/actions/package-lock.json	Updates js-yaml to the patched version for GitHub Actions dependencies.

Review details

Copilot wasn't able to review any files in this pull request.

Files not reviewed (3)

• .github/actions/package-lock.json: Generated file
• ExtensionPack/package-lock.json: Generated file
• Themes/package-lock.json: Generated file

• Files reviewed: 0/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.