Switch back to use YAML instead of JS-YAML #5081

Fixes: #5081

Signed-off-by: Victor Rubezhny <vrubezhny@redhat.com>

Author: vrubezhny

package-lock.json

@@ -148,7 +148,6 @@
 		"got": "^11.8.6",
 		"hasha": "^5.2.2",
 		"istanbul": "^0.4.5",
-		"js-yaml": "^4.1.0",
 		"json-schema": "^0.4.0",
 		"json-to-ast": "^2.1.0",
 		"leasot": "^14.4.0",

package.json

@@ -4,14 +4,14 @@
  *-----------------------------------------------------------------------------------------------*/
 
 import $RefParser from '@apidevtools/json-schema-ref-parser';
-import * as JSYAML from 'js-yaml';
 import { findNodeAtLocation, getNodeValue, Node, parseTree } from 'jsonc-parser';
 import * as _ from 'lodash';
 import { Diagnostic, DiagnosticSeverity, FileStat, FileType, Range, TextDocument, Uri, workspace } from 'vscode';
-import { Document, isMap, isPair, isScalar, isSeq, Pair, ParsedNode, parseDocument } from 'yaml';
+import { Document, isMap, isPair, isScalar, isSeq, Pair, parse, ParsedNode, parseDocument, stringify } from 'yaml';
 import { CommandOption, CommandText } from '../../base/command';
 import { CliChannel, ExecutionContext } from '../../cli';
 import { Oc } from '../../oc/ocWrapper';
+import { YAML_STRINGIFY_OPTIONS } from '../../util/utils';
 
 export const K8S_RESOURCE_SCHEME = 'osmsx'; // Changed from 'k8smsx' to 'osmsx' to not make a conflict with k8s extension
 export const K8S_RESOURCE_SCHEME_READONLY = 'osmsxro'; // Changed from 'k8smsxro' to 'osmsxro' to not make a conflict with k8s extension
@@ -95,7 +95,7 @@ export function getK8sResourceObject(document: string): K8sResource {
   }
 
   // If not JSON or not parsed - try parcing as YAML
-  try { return JSYAML.load(document) as K8sResource; } catch { /* ignore */ }
+  try { return parse(document) as K8sResource; } catch { /* ignore */ }
 
   return {} as K8sResource; // Never return 'undefined'
 }
@@ -393,7 +393,7 @@ export class Neater {
 
   public static safeLoadYaml(raw: string): string | undefined {
     try {
-      return JSYAML.load(raw);
+      return parse(raw);
     } catch {
       // Ignore
     }
@@ -464,7 +464,7 @@ export class Neater {
    */
   public static async neat(raw: string, executionContext?: ExecutionContext): Promise<string> {
     const resource = getK8sResourceObject(raw);
-    return isK8sResource(resource) ? JSYAML.dump(await Neater.neatK8sResource(resource, executionContext)) : raw;
+    return isK8sResource(resource) ? stringify(await Neater.neatK8sResource(resource, executionContext), YAML_STRINGIFY_OPTIONS) : raw;
   }
 }
 

src/k8s/vfs/kuberesources.utils.ts

@@ -3,10 +3,9 @@
  *  Licensed under the MIT License. See LICENSE file in the project root for license information.
  *-----------------------------------------------------------------------------------------------*/
 
-import * as vscode from 'vscode';
-
-import * as YAML from 'js-yaml';
 import { findNodeAtPosition, parse } from 'node-yaml-parser';
+import * as vscode from 'vscode';
+import { parse as yamlParse } from 'yaml';
 import { MappingItem, Node, NodeProvider } from './locator-util';
 
 export function isMapping(node: YamlNode): node is YamlMap {
@@ -112,7 +111,7 @@ export class YamlLocator {
             // the document and line lengths from parse method is cached into YamlCachedDocuments to avoid duplicate
             // parse against the same text.
             try {
-                YAML.load(textDocument.getText()); // this is used to detect errors in the yaml file before actually parse it with the node-yaml-parser lib
+                yamlParse(textDocument.getText()); // this is used to detect errors in the yaml file before actually parse it with the node-yaml-parser lib
                 const { documents, lineLengths } = parse(textDocument.getText());
                 this.cache[key].yamlDocs = documents;
                 this.cache[key].lineLengths = lineLengths;

src/k8s/vfs/yaml-locator.ts

@@ -4,10 +4,11 @@
  *-----------------------------------------------------------------------------------------------*/
 
 import * as fs from 'fs/promises';
-import * as YAML from 'js-yaml';
 import * as path from 'path';
+import { parse, stringify } from 'yaml';
 import { TelemetryProps } from '../telemetry';
 import { Platform } from '../util/platform';
+import { YAML_STRINGIFY_OPTIONS } from '../util/utils';
 import { Registry } from './componentType';
 
 
@@ -117,7 +118,7 @@ export class OdoPreference {
         let isToBeReWritten: boolean = false;
         try {
             const odoPreferenceFile = await fs.readFile(odoPreferenceFilePath, 'utf8');
-            const odoPreferences = YAML.load(odoPreferenceFile) as OdoPreferenceObject;
+            const odoPreferences = parse(odoPreferenceFile) as OdoPreferenceObject;
 
             // If `odoPreferences.OdoSettings.RegistryList` is `null` or doesn't contain the `DefaultDevfileRegistry` item
             // we have to recover at least the 'DefaultDevfileRegistry` item on it because this whole list will be replaced
@@ -157,7 +158,7 @@ export class OdoPreference {
     private async writeOdoPreference(preference: any):  Promise<any> {
         const odoPreferenceFilePath = this.getOdoPreferenceFile();
         try {
-            const preferenceYaml = YAML.dump(preference);
+            const preferenceYaml = stringify(preference, YAML_STRINGIFY_OPTIONS);
             const odoPreferenceDir = path.parse(odoPreferenceFilePath).dir;
             if (!await this.dirExists(odoPreferenceDir)) {
                 await fs.mkdir(odoPreferenceDir, { recursive: true, mode: 0o750} );

src/odo/odoPreference.ts

@@ -4,8 +4,8 @@
  *-----------------------------------------------------------------------------------------------*/
 
 import * as fs from 'fs/promises';
-import { load } from 'js-yaml';
 import * as path from 'path';
+import { parse } from 'yaml';
 import { CommandOption, CommandText } from '../base/command';
 import { GitModel } from './git/git';
 import { FunctionContent, InvokeFunction } from './types';
@@ -15,7 +15,7 @@ export class Utils {
         let funcData: FunctionContent;
         try {
             const funcYaml: string = await fs.readFile(path.join(dir, 'func.yaml'), 'utf-8');
-            funcData = load(funcYaml) as FunctionContent;
+            funcData = parse(funcYaml) as FunctionContent;
         } catch {
             // ignore
         }

src/serverlessFunction/commands.ts

@@ -6,12 +6,13 @@
 import { KubeConfig, loadYaml } from '@kubernetes/client-node';
 import { ActionOnInvalid, Cluster, Context, User } from '@kubernetes/client-node/dist/config_types';
 import * as fs from 'fs';
-import { dump } from 'js-yaml';
 import * as path from 'path';
 import { QuickPickItem, window } from 'vscode';
+import { stringify } from 'yaml';
 import { CommandText } from '../base/command';
 import { CliChannel, ExecutionContext } from '../cli';
 import { Platform } from './platform';
+import { YAML_STRINGIFY_OPTIONS } from './utils';
 
 function fileExists(file: string): boolean {
     try {
@@ -361,7 +362,7 @@ export class KubeConfigInfo {
     }
 
     public dumpEffectiveKubeConfig(): string {
-        return dump(this.sanitizeKubeConfig(this.getEffectiveKubeConfig()), { sortKeys: true, lineWidth: -1 });
+        return stringify(this.sanitizeKubeConfig(this.getEffectiveKubeConfig()), YAML_STRINGIFY_OPTIONS);
     }
 
     private sanitizeKubeConfig(config: KubeConfig): any {
@@ -491,7 +492,7 @@ export function serializeKubeConfig(kc: KubeConfig): string {
         users: kc?.users?.map(toKubeUser),
     };
 
-    return dump(fullConfig, { indent: 2, lineWidth: -1, styles: { '!!str': 'plain' } });
+    return stringify(fullConfig, YAML_STRINGIFY_OPTIONS);
 }
 
 const _kubeConfigErrorCache: Map<string, any> = new Map<string, any>(); // Cache for KC loading errors, allows to skip duplicate reporting

src/util/kubeUtils.ts

@@ -14,6 +14,7 @@ import {
 import { access as accessOriginal, rm as rmOriginal } from 'fs/promises';
 import * as path from 'path';
 import { decompress as decompressOriginal } from 'targz';
+import { CreateNodeOptions, DocumentOptions, ParseOptions, SchemaOptions, ToStringOptions } from 'yaml';
 
 /**
  * Returns the absolute path for a specified relative image path
@@ -31,6 +32,16 @@ export function imagePath(imagePath: string): string {
     return path.join(baseDir, 'images', imagePath);
 }
 
+/**
+ * YAML serialization options tailored for Kubernetes manifests and similar configs:
+ * - sortMapEntries: true     → ensures object keys are sorted for consistency (useful for diffs)
+ * - indent: 2                → standard YAML indentation, aligns with K8s and Devfile formatting
+ * - lineWidth: 0             → disables line wrapping for better readability and stability in tools
+ * - version: '1.2'           → uses modern YAML 1.2 spec (default is 1.2 but made explicit here)
+ * - directives: false        → omits the '---' document start marker unless explicitly needed
+ */
+export const YAML_STRINGIFY_OPTIONS: DocumentOptions & SchemaOptions & ParseOptions & CreateNodeOptions & ToStringOptions = { sortMapEntries: true, indent: 2, lineWidth: 0, version: '1.2', directives: false }
+
 // The following wrappers are needed for unit tests due to
 // 'TypeError: Descriptor for property XXX is non-configurable and non-writable' error
 // that may occure when trying to stub the following methods with SinonStub

src/util/utils.ts

@@ -5,13 +5,13 @@
 import * as cp from 'child_process';
 import * as fse from 'fs-extra';
 import * as fs from 'fs/promises';
-import * as JSYAML from 'js-yaml';
 import * as path from 'path';
 import * as semver from 'semver';
 import * as tmp from 'tmp';
 import { promisify } from 'util';
 import * as vscode from 'vscode';
 import { extensions, Uri, ViewColumn, WebviewPanel, window } from 'vscode';
+import { parse, stringify } from 'yaml';
 import { Alizer } from '../../alizer/alizerWrapper';
 import { AlizerDevfileResponse, Version } from '../../alizer/types';
 import { DevfileInfo, DevfileInfoExt, DevfileVersionInfo } from '../../devfile-registry/devfileInfo';
@@ -23,6 +23,7 @@ import sendTelemetry from '../../telemetry';
 import { ExtensionID } from '../../util/constants';
 import { DevfileConverter } from '../../util/devfileConverter';
 import { DevfileV1 } from '../../util/devfileV1Type';
+import { YAML_STRINGIFY_OPTIONS } from '../../util/utils';
 import { getInitialWorkspaceFolder, selectWorkspaceFolder } from '../../util/workspace';
 import {
     isValidProjectFolder,
@@ -474,11 +475,11 @@ export default class CreateComponentLoader {
     static async updateDevfileWithComponentName(ucomponentFolderUri: vscode.Uri, componentName: string): Promise<void> {
         const devFilePath = path.join(ucomponentFolderUri.fsPath, 'devfile.yaml');
         const file = await fs.readFile(devFilePath, 'utf8');
-        const devfile = JSYAML.load(file.toString()) as any;
+        const devfile = parse(file.toString());
         if (devfile?.metadata?.name !== componentName) {
             devfile.metadata.name = componentName;
             await fs.unlink(devFilePath);
-            const yaml = JSYAML.dump(devfile, { sortKeys: true });
+            const yaml = stringify(devfile, YAML_STRINGIFY_OPTIONS);
             await fs.writeFile(devFilePath, yaml.toString(), 'utf-8');
         }
     }
@@ -504,7 +505,7 @@ export default class CreateComponentLoader {
                 //Try reading the raw devfile
                 const devFileYamlPath = path.join(tmpFolder.fsPath, 'devfile.yaml');
                 const file = await fs.readFile(devFileYamlPath, 'utf8');
-                rawDevfile = JSYAML.load(file.toString());
+                rawDevfile = parse(file.toString());
             }
 
             void CreateComponentLoader.panel.webview.postMessage({
@@ -517,7 +518,7 @@ export default class CreateComponentLoader {
                 id: rawDevfile.metadata.name,
                 starterProjects: rawDevfile.starterProjects,
                 tags: [],
-                yaml: JSYAML.dump(rawDevfile),
+                yaml: stringify(rawDevfile, YAML_STRINGIFY_OPTIONS),
                 supportsDebug,
                 supportsDeploy,
             } as Devfile;
@@ -551,7 +552,7 @@ export default class CreateComponentLoader {
                     try {
                         const devFileV1Path = path.join(uri.fsPath, 'devfile.yaml');
                         const file = await fs.readFile(devFileV1Path, 'utf8');
-                        const devfileV1 = JSYAML.load(file.toString()) as DevfileV1;
+                        const devfileV1 = parse(file.toString()) as DevfileV1;
                         await fs.unlink(devFileV1Path);
                         analyzeRes = await Alizer.Instance.alizerDevfile(uri);
                         compDescriptions = await getCompDescriptionsAfterAnalizer(analyzeRes);
@@ -560,7 +561,7 @@ export default class CreateComponentLoader {
                             devfileV1,
                             endPoints,
                         );
-                        const yaml = JSYAML.dump(devfileV2, { sortKeys: true });
+                        const yaml = stringify(devfileV2, YAML_STRINGIFY_OPTIONS);
                         await fs.writeFile(devFileV1Path, yaml.toString(), 'utf-8');
                         await CreateComponentLoader.panel?.webview.postMessage({
                             action: 'devfileRegenerated',

src/webview/create-component/createComponentLoader.ts

@@ -3,16 +3,17 @@
  *  Licensed under the MIT License. See LICENSE file in the project root for license information.
  *-----------------------------------------------------------------------------------------------*/
 import { randomInt } from 'crypto';
-import { dump as dumpYaml, load as loadYaml } from 'js-yaml';
 import { JSONSchema7 } from 'json-schema';
 import * as _ from 'lodash';
 import * as path from 'path';
 import * as vscode from 'vscode';
+import { parse, stringify } from 'yaml';
 import { OpenShiftExplorer } from '../../explorer';
 import { ClusterServiceVersionKind, CustomResourceDefinitionKind } from '../../k8s/olm/types';
 import { Oc } from '../../oc/ocWrapper';
 import { getServiceKindStubs } from '../../openshift/serviceHelpers';
 import { ExtensionID } from '../../util/constants';
+import { YAML_STRINGIFY_OPTIONS } from '../../util/utils';
 import { loadWebviewHtml } from '../common-ext/utils';
 import type {
     CustomResourceDefinitionStub,
@@ -122,7 +123,7 @@ export default class CreateServiceViewLoader {
                         });
                     } else {
                         // create a new unsaved YAML file with the default data and show it to the user
-                        const serviceYaml = dumpYaml(defaults);
+                        const serviceYaml = stringify(defaults, YAML_STRINGIFY_OPTIONS);
                         const newTextDocument = await vscode.workspace.openTextDocument({ content: serviceYaml, language: 'yaml' });
                         await vscode.window.showTextDocument(newTextDocument);
 
@@ -200,7 +201,7 @@ async function getDefaultsFromServiceKindStub(clusterServiceVersion: ClusterServ
     };
     const examplesYaml: string =
         clusterServiceVersion.metadata?.annotations?.['alm-examples'];
-    const examples: any[] = examplesYaml ? loadYaml(examplesYaml) as any[] : [];
+    const examples: any[] = examplesYaml ? parse(examplesYaml) as any[] : [];
     const example = examples.find((item) => item.kind === stub.kind);
     if (example) {
         defaults = _.merge(example, defaults);