chore: upgrade js-yaml to v4 and resolve Docker vulnerabilities (#10677)

* chore: upgrade js-yaml to v4 and resolve Docker vulnerabilities

### Description
This change upgrades `js-yaml` from version 3 to version 4 to address a security vulnerability (CVE-2026-53550).
To make the codebase compatible with the new major version of `js-yaml`:
- Replaced deprecated `safeLoad` calls with `load` (safe by default in v4).
- Replaced deprecated `safeDump` calls with `dump`.
- Added casts where needed as `load` in v4 returns `unknown` instead of `any`.
- Added package overrides in `scripts/publish/firebase-docker-image/package.json` to enforce vulnerability-free versions of `js-yaml` (`^4.2.0`) and `@opentelemetry/core` (`^2.8.0`) during the Docker image build.
- Regenerated `npm-shrinkwrap.json`.

### Scenarios Tested
- Ran unit tests locally: `npm run test:compile`, `npx mocha -r ts-node/register src/appdistribution/yaml_helper.spec.ts src/init/features/dataconnect/resolver.spec.ts src/init/features/dataconnect/sdk.spec.ts src/mcp/tools/apptesting/tests.spec.ts`. All passed.
- Built and published the Docker image to the staging repository: `./scripts/publish/firebase-docker-image/run.sh --build-project fir-tools-builds --repo staging --target firebase-cli`.
- Verified that the new container image vulnerability report is completely free of vulnerabilities in `@opentelemetry/core` and `js-yaml`.

### Sample Commands
`gcloud artifacts vulnerabilities list us-docker.pkg.dev/firebase-cli/staging/firebase@sha256:5a92b73fc382923834fc396eccbd11ac60c7ae69fecf1df293acf7a1670d7f4f`

* chore: address review feedback and align npm-shrinkwrap formatting

* chore: add @opentelemetry/core override to root package.json

Author: joehan

npm-shrinkwrap.json

@@ -139,7 +139,7 @@
     "glob": "^10.5.0",
     "google-auth-library": "^9.11.0",
     "ignore": "^7.0.4",
-    "js-yaml": "^3.14.2",
+    "js-yaml": "^4.2.0",
     "jsonwebtoken": "^9.0.2",
     "libsodium-wrappers": "^0.7.10",
     "lodash": "^4.18.0",
@@ -198,7 +198,7 @@
     "@types/html-escaper": "^3.0.0",
     "@types/inquirer": "^8.1.3",
     "@types/inquirer-autocomplete-prompt": "^2.0.2",
-    "@types/js-yaml": "^3.12.2",
+    "@types/js-yaml": "^4.0.9",
     "@types/jsonwebtoken": "^9.0.5",
     "@types/libsodium-wrappers": "^0.7.9",
     "@types/lodash": "^4.14.149",
@@ -286,6 +286,7 @@
     "picomatch": "^2.3.2",
     "qs": "^6.15.2",
     "tar": "^7.5.11",
+    "@opentelemetry/core": "^2.8.0",
     "basic-ftp": "^5.2.2",
     "@babel/traverse": "^7.23.2",
     "universal-analytics": {

package.json

@@ -7,6 +7,8 @@
     "diff": "^4.0.4",
     "hono": "^4.11.7",
     "minimatch": "^10.2.3",
-    "uuid": "^11.1.1"
+    "uuid": "^11.1.1",
+    "js-yaml": "^4.2.0",
+    "@opentelemetry/core": "^2.8.0"
   }
 }

scripts/publish/firebase-docker-image/package.json

@@ -67,7 +67,7 @@ const YAML_DATA = {
 describe("YamlHelper", () => {
   it("converts TestCase[] to YAML string", () => {
     const yamlString = toYaml(TEST_CASES);
-    expect(jsYaml.safeLoad(yamlString)).to.eql(YAML_DATA);
+    expect(jsYaml.load(yamlString)).to.eql(YAML_DATA);
     expect(yamlString).to.eq(YAML_STRING); // brittle ¯\_(ツ)_/¯
   });
 
@@ -167,7 +167,7 @@ describe("YamlHelper", () => {
   -
   invalid key: value`,
       ),
-    ).to.throw(/at line 3/);
+    ).to.throw(/(at line 3|\(3:3\))/);
   });
 
   it("throws error if YAML doesn't contain a top-level tests field", () => {

src/appdistribution/yaml_helper.spec.ts

@@ -48,7 +48,7 @@ function toYamlTestCases(testCases: TestCase[]): YamlTestCase[] {
 
 /** Converts a list of test cases to YAML format. */
 export function toYaml(testCases: TestCase[]): string {
-  return jsYaml.safeDump({ tests: toYamlTestCases(testCases) });
+  return jsYaml.dump({ tests: toYamlTestCases(testCases) });
 }
 
 function castExists<T>(it: T | null | undefined, thing: string): T {
@@ -100,7 +100,7 @@ function fromYamlTestCases(appName: string, yamlTestCases: YamlTestCase[]): Test
 export function fromYaml(appName: string, yaml: string): TestCase[] {
   let parsedYaml: unknown;
   try {
-    parsedYaml = jsYaml.safeLoad(yaml);
+    parsedYaml = jsYaml.load(yaml);
   } catch (err: unknown) {
     throw new FirebaseError(`Failed to parse YAML: ${getErrMsg(err)}`);
   }

src/appdistribution/yaml_helper.ts

@@ -341,7 +341,7 @@ describe("actuate", () => {
     expect(writeProjectFileStub.calledTwice).to.be.true;
     const writtenYamlPath = writeProjectFileStub.getCall(0).args[0];
     const writtenYamlContents = writeProjectFileStub.getCall(0).args[1];
-    const parsedYaml = yaml.load(writtenYamlContents);
+    const parsedYaml = yaml.load(writtenYamlContents) as DataConnectYaml;
     expect(writtenYamlPath).to.equal("../service/dataconnect.yaml");
     expect(parsedYaml.schemas).to.have.lengthOf(2);
     const writtenSchemaPath = writeProjectFileStub.getCall(1).args[0];
@@ -368,7 +368,7 @@ type Query {
     expect(writeProjectFileStub.calledTwice).to.be.true;
     const writtenYamlPath = writeProjectFileStub.getCall(0).args[0];
     const writtenYamlContents = writeProjectFileStub.getCall(0).args[1];
-    const parsedYaml = yaml.load(writtenYamlContents);
+    const parsedYaml = yaml.load(writtenYamlContents) as DataConnectYaml;
     expect(writtenYamlPath).to.equal("../service/dataconnect.yaml");
     expect(parsedYaml.schemas).to.have.lengthOf(2);
     const writtenSchemaPath = writeProjectFileStub.getCall(1).args[0];

src/init/features/dataconnect/resolver.spec.ts

@@ -609,7 +609,7 @@ describe("actuate", () => {
     await actuate(setup, config);
 
     const writtenYaml = writeProjectFileStub.getCall(0).args[1];
-    const parsedYaml = yaml.load(writtenYaml);
-    expect(parsedYaml.generate.javascriptSdk).to.have.lengthOf(1);
+    const parsedYaml = yaml.load(writtenYaml) as ConnectorYaml;
+    expect(parsedYaml.generate!.javascriptSdk).to.have.lengthOf(1);
   });
 });

src/init/features/dataconnect/sdk.spec.ts

@@ -5,7 +5,7 @@ import * as distribution from "../../../appdistribution/distribution";
 import { AppDistributionClient } from "../../../appdistribution/client";
 import * as appTesting from "../../../gcp/apptesting";
 import { McpContext } from "../../types";
-import { safeLoad } from "js-yaml";
+import { load as safeLoad } from "js-yaml";
 import * as fs from "fs-extra";
 import * as path from "path";