fix(yaml): migrate to js-yaml 5 API and restore green CI

[vandetho]

main has been red since 2026-07-08. Two stacked breakages, both from dependabot bumps:

1. typescript@^7.0.2 fails npm ci (introduced in #67)

npm error code ERESOLVE
npm error Found: typescript@7.0.2
npm error Could not resolve dependency:
npm error peer typescript@">=4.8.4 <6.1.0" from @typescript-eslint/eslint-plugin@8.65.0

No released typescript-eslint supports TS 7 — latest stable is 8.65.0 and it still caps at <6.1.0 — so bumping the plugin doesn't help. typescript is pinned back to ^6.0.3, and .github/dependabot.yml now ignores typescript semver-majors so this doesn't come back next weekly run.

2. js-yaml@^5.2.1 breaks typecheck (introduced in #64)

This was hidden behind the npm ci failure. #65 previously reverted js-yaml to 4.x; #64 re-bumped it. This PR migrates the code forward to the v5 API instead of reverting again.

src/yaml/export.ts(76,9): TS2353: 'quotingType' does not exist in type 'DumpOptions'
src/yaml/import.ts(21,31): TS2339: Property 'Type' does not exist on ... js-yaml
src/yaml/import.ts(37,29): TS2339: Property 'DEFAULT_SCHEMA' does not exist on ... js-yaml

js-yaml 4 → 5 migration

v4	v5
new yaml.Type(tag, { kind, resolve, construct })	defineScalarTag(tag, { resolve }) — resolve/construct collapse into one resolve(source)
DEFAULT_SCHEMA.extend([...])	CORE_SCHEMA.withTags(...)
quotingType: "'"	quoteStyle: "single"
styles: { "!!null": "canonical" }	removed — see below
import yaml from "js-yaml"	named imports — v5 has no default export
@types/js-yaml	dropped — v5 ships its own declarations

Two judgement calls worth reviewing:

• CORE_SCHEMA, not YAML11_SCHEMA. v4's DEFAULT_SCHEMA used core scalar resolution. YAML11_SCHEMA would have silently started parsing yes/no/on/off as booleans — a real behavior change for place and transition names. The YAML 1.1 collection tags it also adds (omap, pairs, set, binary, timestamp) aren't used in Symfony workflow config.
• ~ for null. v5 has no styles option, and styles: { "!!null": "canonical" } was what produced ~ rather than null in exported YAML. Restored by spreading the exported nullCoreTag with an overridden represent, then passing that schema to dump.

Verification

Full CI step sequence run locally — lint, format:check, typecheck, test (246 passed / 14 files), build. All green.

The existing suite already covers the two behaviors most at risk: expect(yaml).toContain("draft: ~") (tests/yaml.test.ts:74) and the !php/enum tag suite. Additionally smoke-tested the built CJS bundle to confirm the named-import switch survives the tsup transpile — export/import round-trips cleanly with ~, flow arrays, and single-quoted scalars intact.

🤖 Generated with Claude Code