chore: adjust dep

packages/plugin-commands-installation/package.json

@@ -84,7 +84,6 @@
     "@pnpm/types": "workspace:7.6.0",
     "@yarnpkg/core": "^3.2.0-rc.4",
     "@yarnpkg/lockfile": "^1.1.0",
-    "@yarnpkg/parsers": "^2.5.0-rc.3",
     "@zkochan/rimraf": "^2.1.1",
     "@zkochan/table": "^1.0.0",
     "@zkochan/which": "^2.0.3",
@@ -93,6 +92,7 @@
     "enquirer": "^2.3.6",
     "is-ci": "^3.0.0",
     "is-subdir": "^1.1.1",
+    "js-yaml": "^4.1.0",
     "load-json-file": "^6.2.0",
     "mem": "^8.0.0",
     "p-filter": "^2.1.0",

packages/plugin-commands-installation/src/import.ts

@@ -22,7 +22,7 @@ import exists from 'path-exists'
 import recursive from './recursive'
 import { yarnLockFileKeyNormalizer } from 'snyk-nodejs-lockfile-parser/dist/parsers/yarn-utils'
 import * as yarnCore from '@yarnpkg/core'
-import { parseSyml } from '@yarnpkg/parsers'
+import { load, FAILSAFE_SCHEMA } from 'js-yaml';
 
 interface NpmPackageLock {
   dependencies: LockedPackagesMap
@@ -179,7 +179,10 @@ async function readYarnLockFile (dir: string) {
 
 function parseYarn2Lock (lockFileContents: string): YarnLock2Struct {
   // eslint-disable-line
-  const parseYarnLock: any = parseSyml(lockFileContents)
+  const parseYarnLock: any = load(lockFileContents, {
+    json: true,
+    schema: FAILSAFE_SCHEMA
+  })
 
   delete parseYarnLock.__metadata
   const dependencies: YarnPackgeLock = {}