fix: migrate YAML parsing from js-yaml to yaml

[stevenjoezhang]

What does it do?

Fixes #5801.

This migrates Hexo's direct YAML parsing and stringification from js-yaml to yaml, and removes the direct dependencies on js-yaml, js-yaml-js-types, and @types/js-yaml.

js-yaml-js-types extends the schema with !!js/function, allowing YAML input to construct executable functions. The new shared parser rejects unresolved tags such as !!js/function, while preserving the existing behavior for:

• YAML timestamps parsed as Date
• YAML merge keys (<<)
• !!js/regexp
• Duplicate keys in JSON multi-config files

YAML parsing and stringification in the renderer, multi-config handling, config command, and scaffold front matter have been migrated. Related tests now use yaml as well.

js-yaml remains a transitive dependency of hexo-front-matter@4.2.1. Upgrading to hexo-front-matter@5 is kept separate because it is tied to the timezone migration. The vulnerable js-yaml-js-types dependency is removed entirely.

Local validation:

• npm run build
• npm run eslint
• YAML renderer tests: 6 passing
• Full test suite: 1281 passing, 5 pending; the 7 failures under Node.js 26 are also present on the base branch and are unrelated to this change

Screenshots

N/A — internal parser and dependency changes only.

Pull request tasks

• Add test cases for the changes.
• Passed the CI test.

[github-actions]

How to test

git clone -b fix/issue-5801-migrate-yaml https://github.com/hexojs/hexo.git
cd hexo
npm install
npm test

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/esprima	4.0.1	🟢 3.9	Details Check Score Reason Code-Review 🟢 3 Found 11/29 approved changesets -- score normalized to 3 Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Binary-Artifacts 🟢 10 no binaries found in the repo Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Pinned-Dependencies ⚠️ 2 dependency not pinned by hash detected -- score normalized to 2 Security-Policy 🟢 10 security policy file detected Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/yaml	2.9.0	🟢 8	Details Check Score Reason Code-Review 🟢 7 Found 3/4 approved changesets -- score normalized to 7 Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 2 dependency not pinned by hash detected -- score normalized to 2 License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• package-lock.json
• package.json

[github-actions]

Flamegraph

https://15a53e101e8607fe62e4466c531286f32e463ec5-20-hexo.surge.sh/flamegraph.html
https://15a53e101e8607fe62e4466c531286f32e463ec5-22-hexo.surge.sh/flamegraph.html
https://15a53e101e8607fe62e4466c531286f32e463ec5-24-hexo.surge.sh/flamegraph.html